68cd4c2bf0b94798bc04ee6bdf44c80cd9e2938ffd9d226d18af8b1c0c4bd135

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd3877b24bab590f322b677f7a4cc08f_JaffaCakes118.pdf
Size

83KB
MD5

bd3877b24bab590f322b677f7a4cc08f
SHA1

b969a9084a0370dcd6642de1cba88fdbc92dcb1a
SHA256

68cd4c2bf0b94798bc04ee6bdf44c80cd9e2938ffd9d226d18af8b1c0c4bd135
SHA512

23dd217a694d3f21f4aede1cbe8c41cf356b3eeca29f0348c0b73cd8b26d452463fd404391b3713ed67519a47bccf86b1c64a65a428b29287af632aad16a368a
SSDEEP

1536:5KxECPg1kYhCiG+OFy7jF4rGnZxe9WxApOGzWC6ryuSrsnCDUQD9:1o+YqjGGW63G16muSQnCIO

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2392	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2392	AcroRd32.exe
2392	AcroRd32.exe
2392	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bd3877b24bab590f322b677f7a4cc08f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d1d17454fbe18001db62dbddbf0d44f8

SHA1
dddbdb938ed02979a16febd839bc98ee88a328a0

SHA256
0349dec5d5096d7ef04f668c22660f06fb71fb67a6e4edfd762ccc9a4d74124e

SHA512
a3fbb2eab6c2008347ab68852aa1ef83881b0be4d208e6d7210c89d7a4f8f801570a53043918e0918c9645d3d53cf091f7b42ee1b29614e6e4170b5eab448e0a

Download Submit