2b09e186f856f2486b69d3c9f3ad16e2ed52686fbc9c88743cf76d50e473c19f

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9f0c6b270f953fbbfdda121b405e648_JaffaCakes118.pdf
Size

84KB
MD5

b9f0c6b270f953fbbfdda121b405e648
SHA1

3e1c18241b864a854197602b8be53f3902446962
SHA256

2b09e186f856f2486b69d3c9f3ad16e2ed52686fbc9c88743cf76d50e473c19f
SHA512

83b3bb2bf2ece00861646da1058a08a1c29bc31727961e52400393af00bfd446341bc7491b6f3032d8cef1cc167e4948feadb4a890b35d5b28a84b0803ac8815
SSDEEP

1536:hbJxbisWacQPeim9bvPVDFD+l9yF8Z4+PSPXz3zW5bq4WB2+qDZW6pOu2iLCGi4+:FbhcQGHLIGc4SAzsehe6u2sCf4RM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2508	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2508	AcroRd32.exe
2508	AcroRd32.exe
2508	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b9f0c6b270f953fbbfdda121b405e648_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
96c9046783fbda19cbc3c152f43e1374

SHA1
aa906dba11397e6cfbd6ccbfc7a17be782dcc45b

SHA256
7d6102c3e0eab9b89ba2c28d9474cb9ba1af598031bbbed0e50a87551f27b875

SHA512
6f16531d214a94355694efbc010388a9de05747fecb691d285a31f233759c2fb5d4f1f8d2c58298433b5a0555dcce6864f6bf222e3e16c958443a3b3a332d462

Download Submit