959f0eaa15a70adbdd358ea3ead94af2175478b6eb415a439449fdabd8fd1b09

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1d025b2b7fe0f7aab49a216f2eaabda_JaffaCakes118.pdf
Size

66KB
MD5

b1d025b2b7fe0f7aab49a216f2eaabda
SHA1

eac2b47011ac3c92a418b0ae03cbf8776a628437
SHA256

959f0eaa15a70adbdd358ea3ead94af2175478b6eb415a439449fdabd8fd1b09
SHA512

da8977951ba3b17b5febdb39c7395ffaa5415cc22a6962c2a5efe6bc892e53f612a9dc6b5a7987212e792b1b83291a507d08390cb7a18292c6c1f8b5b86dbac6
SSDEEP

1536:Aytp7u2V7rC4UsF0vD6HNCoBNh+VqvCAtPagddIEdzY7Yq:btpTHCpZL6HNlHUC/IBV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2708	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2708	AcroRd32.exe
2708	AcroRd32.exe
2708	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b1d025b2b7fe0f7aab49a216f2eaabda_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
94fad9c514cb2c1d9722a21a098cae07

SHA1
3e489be27f77b75cd54329ebbf6b5f3f3118db17

SHA256
468ecb0706c094b05889fc9cc5288324e1af53c80cf94ac06106a7da965a21cf

SHA512
abb096636652317aac6f6cacd62dcad766ac93e7e3466896eada0da9fef2efbb10d68eb10242844c1bca65255247f7ee52fe8f8b72f46fef0ac2db2e036cc62a

Download Submit