51481079d5ca4683564f77439b1fa7303a0efd2b6d014b63981a8086882d5d8a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b61d0df9250be46b8edbd4236c96f4bf_JaffaCakes118.pdf
Size

81KB
MD5

b61d0df9250be46b8edbd4236c96f4bf
SHA1

16e3775a2e6f193f1ddf96ec4d74396ef8ba4d09
SHA256

51481079d5ca4683564f77439b1fa7303a0efd2b6d014b63981a8086882d5d8a
SHA512

4986273a02f034d91a043e3ca955cba4a3ef01f6b8088b672ebe96a7edf9d62817a6a8b9245e18e33a16c5c3512e59e1c59d826a408577d9626ec4fb86708d37
SSDEEP

1536:u968xvjs9++vlDs0aR8YPr52qxBxPAD1Vmp+VRNB76VzQEjzQNT4CWeQWypOlL99:KDdjs9++v1snP9DBxPABVmp+VRNB74zW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2672	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2672	AcroRd32.exe
2672	AcroRd32.exe
2672	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b61d0df9250be46b8edbd4236c96f4bf_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
63d315d0849afebb7c6ad72ca0c3cdb5

SHA1
4593b46d8e7d59720bbedccffff83b1163d44be7

SHA256
88ed90d384ad4763f5908cdd54438e60d651abcdcf43450ba33264a902ddf663

SHA512
cad0014f285423674a610e706956b4cbf6889469d6ccbb0ae0042e3cac4689aaacd2bb7d27ec1d2e4b135e8a76c18ed6c3febf086fd962a800aef1c961899754

Download Submit