07d10cdb61884cd893f34669794863c67bb8770aa5189edacb36e90a9118223a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 02:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1bfd131008e64384cb4b80dff24bbad_JaffaCakes118.pdf
Size

85KB
MD5

b1bfd131008e64384cb4b80dff24bbad
SHA1

3a1546f7c1ed5e568e2918835dd61fe5ec6eb364
SHA256

07d10cdb61884cd893f34669794863c67bb8770aa5189edacb36e90a9118223a
SHA512

3ba2770c51f88b73994657823ce4923f27dab49af11f0f3a795cd38652aaec1b1fb5c08b8c15f45515175ce4c219ab0245cbc8b6a0f13a621b4237215b92706f
SSDEEP

1536:UaVSv8ewvUgOOIBBODRR8mqHXre577DjWbzIsCWenUQ2sXFVlNU5sGpWspO2c/QK:5vUgZIBMDLq3rEFIsXFVzU5sGI26

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2500	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2500	AcroRd32.exe
2500	AcroRd32.exe
2500	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b1bfd131008e64384cb4b80dff24bbad_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
16cd9d94ef9fc5444e8db0f21198427d

SHA1
43f9c626f35ee840e22d4452cb160d1821007114

SHA256
74f5e377cbeb60d7e21145aa25b39b53cd4d35369b473577f17ecdb037665612

SHA512
5941c2070007ccfa106c1059931c3ce536b161336574e241e7cb0d22089c86974a001448eabbdb3cea5911cc54487e5bd028ac5d91bb028583bf7ae39ef89046

Download Submit