85015aa01c075a1e0c1e039a8c8b937a0f5eb29c14dc709c32e6ee8cb8cd710c

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd9f137695e290503c6e1bb8d1ba10df_JaffaCakes118.pdf
Size

42KB
MD5

bd9f137695e290503c6e1bb8d1ba10df
SHA1

bc39ff1ae4b417a48ef1af763413535b13682306
SHA256

85015aa01c075a1e0c1e039a8c8b937a0f5eb29c14dc709c32e6ee8cb8cd710c
SHA512

c6708d6e911dde3f8313f242ae63e30c567c129cc14b1a4dc6b66bc677e6a13c20ec143f6f63782e80791656fe131d04637f2dd958645fafb29c0ee26886540b
SSDEEP

768:bA2lRjIfG7ZCW1ix2gUaNFk2vJ3bz1B/kLVZxnrxInS661TdNqDEZPKbGF1HE5RG:bAmjNtcx2gUaNFk2vJ3bz1B/kLVZxnrN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2120	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2120	AcroRd32.exe
2120	AcroRd32.exe
2120	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bd9f137695e290503c6e1bb8d1ba10df_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7b5b229ee3b86fd6bde7f534049f3808

SHA1
3e9a948fcd6352e1bef8b62fcfaad1e894e94695

SHA256
4b979bf86f95a0a45a75f4a54c08dd7a9da875d35d883681e4743e34a38f83d7

SHA512
7f92afa6ce441f8eda9fc8663dadd5b64e337f86eba23847e5f9fddba2a862bdf7aa9c9221418965ede7097512cd4cc07ae7d6fcf6268b498468cc2b4d037abc

Download Submit