ebbe0511ad8e626875f80c0ecb054a7e65d456281b0e7715747c9d1067096ccd

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b80f077dcdebe8db44e3fdb217cf8dd3_JaffaCakes118.pdf
Size

76KB
MD5

b80f077dcdebe8db44e3fdb217cf8dd3
SHA1

3d81195bdfa323c813e87c1b1462a206f8a234db
SHA256

ebbe0511ad8e626875f80c0ecb054a7e65d456281b0e7715747c9d1067096ccd
SHA512

6f4e716b4750fe0ff1a7208cbf4314f26966e616a5d00617c868435542c50cfe7d7446634750ac05e20d3552c6f87fe91ec9e3eae0522c7eda8bcbb4dcc065a9
SSDEEP

1536:NfdUyNg+qRgXdUFdUXpgJnX7D1cVZRmRVSxl/2iQzQEwk3RMb4QngWTHWx5bS:jy+qqGbIpgtPSVZRD/2R8EwGmkQgWTm4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2848	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2848	AcroRd32.exe
2848	AcroRd32.exe
2848	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b80f077dcdebe8db44e3fdb217cf8dd3_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9d7a497119fe847072cef4a5f2228a4c

SHA1
677c7fe85454c7291a8e3075a7ee31d6d99e208e

SHA256
8fd6ae0dc1e40f4b044e4175a9fd48174c8c9931b8ac1ec7c04922bdec85ff1b

SHA512
26296720bb612efc87c02de9a0efcbf9b08bb0d37e65daaefa33bd82147bb3380306c48521330b0fa486c7268c213022b7ac8f43712925124931141f46ca994a

Download Submit