88bd44f367da38606d933dcf6a05f8cc6a48f89f586afa07bebf6f44cf3af6fa

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bca7d7a1b540d320e7a10aa3594a51ab_JaffaCakes118.pdf
Size

76KB
MD5

bca7d7a1b540d320e7a10aa3594a51ab
SHA1

ffc23ccefb5f8c3ab3c9546ee468e12404439218
SHA256

88bd44f367da38606d933dcf6a05f8cc6a48f89f586afa07bebf6f44cf3af6fa
SHA512

74cb7d54fc97b4d0c6efa8d6a42efb0318af2135c4c16d34bf189e8ec38a7e832ee295a98a1b6bd6352e71dc98bd5ecbb2dc57b1657398f7d27c9eb7f9a60aa6
SSDEEP

1536:jjqfy3sRNUEiaMjj1npVMXgUC6RUeS+CCFC2WH9lTmCclHWspORSyfWBobvd:XOOMduPOwxMUeS+ZC1Cl2R9Yg

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3028	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3028	AcroRd32.exe
3028	AcroRd32.exe
3028	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bca7d7a1b540d320e7a10aa3594a51ab_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9217cb088c9678576d3d669f0849d676

SHA1
f9fd082a70973993ecb5259e153a2e277575a933

SHA256
769b761a0d94be30099bc75bc536e5dd118cb33619818f1e5a5266552a71b729

SHA512
48d746555116c88571c891525c60b6f6695bf5c6a20b143ad76f18d8e13c820905773388b67cec3f4d315807bc606dd58a768a42b01b25a4d311fd511c8a722a

Download Submit