c6d82428cfd9214d5a9d0f68d395dc47fc8911b7e022bc5d28e93480e6f8007d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd113a83304d35812707812dd2a6a3e9_JaffaCakes118.pdf
Size

34KB
MD5

bd113a83304d35812707812dd2a6a3e9
SHA1

ab6236171e5e31e30c52a9984f55989aeebe8e3b
SHA256

c6d82428cfd9214d5a9d0f68d395dc47fc8911b7e022bc5d28e93480e6f8007d
SHA512

1ea7951803ef2a98dd91f94c1767fb8987b9c17aef0dcd287d084003a290765f41e349dfcde16abfbec40300be3dfb4bd4cb64b1a1fd2d254b9f77a8ef6691d1
SSDEEP

768:ryeOUPiQsZ5igOYb8uG7n1mM2OJ0l3YMK2pQC:JOxsAm7n8Dl3YMK2p7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2384	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2384	AcroRd32.exe
2384	AcroRd32.exe
2384	AcroRd32.exe
2384	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bd113a83304d35812707812dd2a6a3e9_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bcddcd1307e4cb3d5f009b330115e5d6

SHA1
d7001d32a2dfda1fc6ba0f55b608587b00a8dbac

SHA256
ec5d5f16a830efe304e9ccd6a21a72ae839fd9dc3fea75c7bd0a884a6e4fd032

SHA512
9b7eb561b643979fa2e546dcd58d94fdde825bd69b60d0527dd6ec647f06ba56602e2ea3d7d9684a7910fe6803fbc37915f37ba5b5f234babbf3053153498d73

Download Submit