6f741a96737643077b82cc31d770732152c694f5f2cf75b38dd6f5e1bf06aba7

Analysis

max time kernel
92s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bae03765694a8a5f695efd375300e7ad_JaffaCakes118.pdf
Size

9KB
MD5

bae03765694a8a5f695efd375300e7ad
SHA1

28d8ddc6ed7ce7f110a8f3384b4f17ae325d4356
SHA256

6f741a96737643077b82cc31d770732152c694f5f2cf75b38dd6f5e1bf06aba7
SHA512

e600f78f8372ca80429fb6a0f36c70d0b5f6c2e0759ef564011b6dc00b7e71f1179b5dc817198f289b68165f11d7cd56cedbea0a3f7c7aaae9f962048550c8a9
SSDEEP

192:Yyj3OBJs0i9qGcf+CmlNLzx2WcrejoJ9DLUTakrs/+D:YseH5i9qZf+zlNLzx2WlEJ9MY/+D

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2352	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2352	AcroRd32.exe
2352	AcroRd32.exe
2352	AcroRd32.exe
2352	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bae03765694a8a5f695efd375300e7ad_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1a8b29ace7fa2792004ddf6fbfa4712e

SHA1
6c8778b0437066cb2ea37244fdc3ae9efc9af438

SHA256
5d975b49c74594ce8d7be2201331125c4eb8e8b16dc3e71b872b5c638097746b

SHA512
e2f471cd99f43f21601efffa5e4861a95557735eef5e07364686988fdcdb9b90704dd91c252d9482784dc4881d373d97c00208424471e599bf849a650eedc952

Download Submit