8567177554815997ce04d1bd349ebc515ebd307bcd2483f6869593d471696bf2

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf77f4672b45034663a7d7eb0a6e54d5_JaffaCakes118.pdf
Size

91KB
MD5

bf77f4672b45034663a7d7eb0a6e54d5
SHA1

78637e3883d313a738a34a56b8fadcc62713d042
SHA256

8567177554815997ce04d1bd349ebc515ebd307bcd2483f6869593d471696bf2
SHA512

990cd8f996c1984d73a5e369eb8daa350e1474eebac5300d42f2142dd5289612aff0def4cdf9ec9ab0506528d7f011fe892edbca5abca3cf597bc745aee1fed4
SSDEEP

1536:PKPs01DhPZVRBdzPImHnswjL6K94ZAOUZu2KY1IWrKqPDNb5WapOtQSWa62fk:msGDVbBImHnswjWGf4239KqL9WtQSR6z

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2928	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2928	AcroRd32.exe
2928	AcroRd32.exe
2928	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bf77f4672b45034663a7d7eb0a6e54d5_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
01736b9d2e30ab538fb366dd6f30d594

SHA1
f1e4b265926d3892329a822c79359ecc5b70836b

SHA256
3520fbabc60dede830b427113d38a253df450140389b2a78d5d177a1e63f3b8b

SHA512
8c3016f5bf3db4a741a885bccc53d19f3cf429634b2b759e52705252817c2edb63a2ba1399d9768f1d2f4636058bf666213130c7cb5d368ccf09aa6d829490d5

Download Submit