7389200fe985fa0ef4875701794da28a3fee179da75fb7a6d942ab7f3f8e9523

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbd5422e487ca3f4343ef84fdab01b92_JaffaCakes118.pdf
Size

80KB
MD5

bbd5422e487ca3f4343ef84fdab01b92
SHA1

0cf403b0082fb55b2ce89c489c6fa891771b8fa5
SHA256

7389200fe985fa0ef4875701794da28a3fee179da75fb7a6d942ab7f3f8e9523
SHA512

b9d5d12e962d9822c36a83f030400ca3d84bd81a9d43b76633a69d3386f3243f106ac08fd787cb81f2910ae478009dcde55e202f9e0e3f963fd07f14f43be128
SSDEEP

1536:sBjCT+gVrVKOO7l6/rdIMAGP2uV4CQIkwVA1RWxYK5e0HxW8pO+W4lu:cjCKQrVKOO7McuVvQTwVY2t5tQ+q

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2332	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2332	AcroRd32.exe
2332	AcroRd32.exe
2332	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bbd5422e487ca3f4343ef84fdab01b92_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8a1607f3502453e8438570920cda939e

SHA1
88c28122637598bc04f9ea99134c8b99199b6853

SHA256
8493e7e5603e34e26279ccac6943db19c0495caaebf387c5f02ce39840a4a084

SHA512
6d30b8e385b00b5c8033f8f3d34e725bd4fbde91a162b76d1078b9e4fa24692077bb1204aefba190ce3827d8cea2beca7dc093aa94a0de9db2814351ddc6ba5e

Download Submit