658c5d4796b340f448111d04ddf07fcbe14c24227962c3900c67f839baccd2a3

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 21:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b93e4c2483009627da2165a66def406b_JaffaCakes118.pdf
Size

74KB
MD5

b93e4c2483009627da2165a66def406b
SHA1

a90b75b9b92310d45ff268c73bb31c76324c0504
SHA256

658c5d4796b340f448111d04ddf07fcbe14c24227962c3900c67f839baccd2a3
SHA512

22bb9e54f3f901e9a6069555935174df7e77e50d5af328aa731fd150ad96ae5ba4172fd5e03e39e90392eda05c8ccfe9949ff1c1644c1a8a36c531cee58aa51e
SSDEEP

1536:opchllGL7vqWZ3fER6m1X1rAXcOFFGLkOx62iKZYqqWapOtQHW5K5NTHrXw:thlAL7v6R6muFFYQ25XXtQ4K51Hk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2180	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2180	AcroRd32.exe
2180	AcroRd32.exe
2180	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b93e4c2483009627da2165a66def406b_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3ceb4213e2bf44ae2d7ab5edd7e09784

SHA1
272a0e23d7f14d3ba5433a6067108d939d4aaf41

SHA256
0d10d81d4c4636e323eedd9e836cb07f40633f9849008eea99758b835858284a

SHA512
809d54d0228eaa867c87a49775e28f1b5aec89b8d8575e474355fee775f7c370424a22d8f14b61429e1e105dbba7927af819a22907212dd266684f9c99956c2d

Download Submit