908d7080f7fb4fa283550ee3315b5c3745cd5000b47eb783c5e05ba69e5efa29

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1d6b61ad763674d8d06bb19c6d95454_JaffaCakes118.pdf
Size

153KB
MD5

b1d6b61ad763674d8d06bb19c6d95454
SHA1

b44349e959c636b95a534a6549672b83a2a20193
SHA256

908d7080f7fb4fa283550ee3315b5c3745cd5000b47eb783c5e05ba69e5efa29
SHA512

d58500590cca430a15529a4611269b090b0fc2e1e6644c09365678818f095180d4fba458fd2afeaf3c99a781b25f7537d88462da0690c61c8de8c27fbf4c7502
SSDEEP

3072:gGciAQyNFfGAVu+5osDExU2WcT6aMoH3sXgffdkwI/7IaOU+ZgbwP:gXPVFOAJyZf53sxyUub

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2732	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2732	AcroRd32.exe
2732	AcroRd32.exe
2732	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b1d6b61ad763674d8d06bb19c6d95454_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
21533570b67e900eb0d7829334863c83

SHA1
3476ec5b2d29e5c508cb562b7e32ffa68f1b640c

SHA256
0227c7a24064e5ca43140a2fca9111337ac0e752c49c05facc95079a88c8060e

SHA512
2421fe34ce7c6b1c327f364a43e3faa495e8835d9d34ea5799dde14d77c30c6db2f1f0adf454052a31c4e9ccb06c1e8a7ba7160eb3f976ef85a44697a39d2a2a

Download Submit