534dd7215ea5f7db4d8866111a812459fdb286e5e8a99987f9cb5e05bfbdae16

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5bc45cec64d0eb6dd108a397035b1e1_JaffaCakes118.pdf
Size

72KB
MD5

b5bc45cec64d0eb6dd108a397035b1e1
SHA1

06193967a04f07461b769dc21a7491981696b2d2
SHA256

534dd7215ea5f7db4d8866111a812459fdb286e5e8a99987f9cb5e05bfbdae16
SHA512

8eb085315a681dc2b44563b3eb2ec361318eefe8a17d4723ef93558dfb08a7623adb3b22c3ce0ddf8501261195dcd9818351dc88ddbf839658f473af331012e8
SSDEEP

1536:Cm2IQFwA+JZ21n2dhmUQ8LsMAXG6dS2upvgdCJTls2Q/5u2:1m62R2OUQ8LiG6Y1Ru/9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1472	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1472	AcroRd32.exe
1472	AcroRd32.exe
1472	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b5bc45cec64d0eb6dd108a397035b1e1_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3a3d07734e51dc082004e174d009c150

SHA1
a4e525b1931e5b20196d43e9b5372b352c5ef503

SHA256
6383d5a150f74f7276b6b62a7c6d38d63b8d8073278875f15ff30b4e042f523f

SHA512
0653b1699bd225c2ecefe2ab1a6192c6d0617ea6ef81d28cb76ab4ee00eb70befafb0f6807a308f5cf2f7a7b1ffff9f16e0cbad1ce1dbc4f40d39a7a765a3d08

Download Submit