bf282624d15201b63b9c56f80b5ed28d0b3727509343f334204443c722005790

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5c7b7a1a8f06be034bd93e0fe7f2b8c_JaffaCakes118.pdf
Size

68KB
MD5

b5c7b7a1a8f06be034bd93e0fe7f2b8c
SHA1

dbfa0711f7c43e644180791b54e62403f727f1d7
SHA256

bf282624d15201b63b9c56f80b5ed28d0b3727509343f334204443c722005790
SHA512

2191d72c906dc072be2546716431dace602f91999e661e1ec04ac4e743cf16ad421d08b197cee1f17812ad35c4e4b57e289fe3a90bf79935dbcd8fddd904360e
SSDEEP

1536:SGF+dTJN1OVI/A+NraVQiSKy2jj+50kH5dTg9suO9sp:LF+dX6ItNa1SKDPs0kHg9ss

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1540	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1540	AcroRd32.exe
1540	AcroRd32.exe
1540	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b5c7b7a1a8f06be034bd93e0fe7f2b8c_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e3214a5e37b3cbf5827a47c1d4a61b4c

SHA1
e5cdc34576b2bd09c91bf795986ae9764c5a0940

SHA256
c1524e9d717abd41024d6b30ee11869d371f12b81ca33521c619bec8d7d0ff0a

SHA512
c22ed5285b2810d2c34aecb87f5a2325863149f8b1e14afa09d51ef805cd903d52fa60fa4fd3c230ae530da67b381f0777f2e54f448bda81fbe82559a3be1835

Download Submit