9e7fc1efb0d568f63cc0eb01b363382a13387969b2780489961d23d653e3698f

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b53dab177db7a2ffe84b33c0287df3c0_JaffaCakes118.pdf
Size

87KB
MD5

b53dab177db7a2ffe84b33c0287df3c0
SHA1

c6e25e00c3df1e7ce410899a0388e97137f4862b
SHA256

9e7fc1efb0d568f63cc0eb01b363382a13387969b2780489961d23d653e3698f
SHA512

0949290c404b614487f831628c485f43ed478b1b3d02d6ee289b84efbbd6f20e0f3f7e92662f2cf984db51498aca697d471c634b4ca7413574ca1f017de86a6b
SSDEEP

1536:BelnFll4eiT8/QSNinnmgMLhEL0QaXxz6/FRMGqWKW8pO73Wzt/encvO3puK:wlFlczZMyAQaXw/FRMGqWR7qdecmZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2088	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2088	AcroRd32.exe
2088	AcroRd32.exe
2088	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b53dab177db7a2ffe84b33c0287df3c0_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
427aadb0ed68109049be2d8ec3ab94d0

SHA1
4330a614f8de70d3b36a2c1e24e50ff615e7f963

SHA256
8c0b3b90d5cb25fabe8c8d0aa8a34538de685f29783c4137b2e0134d06de7a0c

SHA512
46e2753d5f97382c64dc57d4a19f6e1628ff1557446aff96b2ebf85588f5f3afeb0f13c300f7b4511faf292e6142c1de8462b5b70814243a0a9aa3fc76ddfb3c

Download Submit