b01e8efb1127c449a6edcbb5c8d3b9554ef7505a0cfa508e4cd74c0666d310ff

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb56c3db98352db733befcceef5f4628_JaffaCakes118.pdf
Size

86KB
MD5

bb56c3db98352db733befcceef5f4628
SHA1

214f95130ebaa4085d8234b7b660b31769a2091e
SHA256

b01e8efb1127c449a6edcbb5c8d3b9554ef7505a0cfa508e4cd74c0666d310ff
SHA512

a784cf2ef47491c3a5f6cd16e60dbebefa966c201273c7e6a4d9603598b5b1ac22c136b4d66db704450610ee0a1fb2b1cf93c7a1178f45c1b4c3babfbd0082cc
SSDEEP

1536:QIJyd9kBSuedU50aapOd9CRdKfxTQQAOW6pOu2tg9WaEawFx+nLJij:y9qYgd9CRdA1QPLu2tg3wFx+8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2876	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2876	AcroRd32.exe
2876	AcroRd32.exe
2876	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bb56c3db98352db733befcceef5f4628_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3b503206a185cf5990ca89bece998367

SHA1
665962afc40a4ddb776a50227cb33d709f787e7a

SHA256
fa54d200fec019caecd4d6c9e6b550c4972065fc9d9143da5fca5d17fd39241b

SHA512
7a9f1b209a45aed1abf1c021d3d1f0f5de2ea67bb0eb56f107f881a57a00e518b5e19ddb1ae39df640fcb1302894f43eebd419675adcba8881ff2a71dbbfe924

Download Submit