cf62561fb0690db4e334b8a00569673700f02bffb9f0ec5128e2ffca8292312e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be55ae37252e82c20339ad448cfe3755_JaffaCakes118.pdf
Size

55KB
MD5

be55ae37252e82c20339ad448cfe3755
SHA1

d77eb041eecb112ba6423952a0c40e0ea56cb4e4
SHA256

cf62561fb0690db4e334b8a00569673700f02bffb9f0ec5128e2ffca8292312e
SHA512

c5ec626d56a0aa1aabd931b9e6be8758ac0bbe69f0007c0c807edd0901a16f197bb06a5dc6cda60e36a677d2291af4f4ccee696915c4dc218acdc95eb62c2961
SSDEEP

1536:wGFeiDvMnlHdvab5BUv+RP4C2HHiWdRCoRI8Nq:9FeIvcZdyO0PM/AoRIF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2212	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2212	AcroRd32.exe
2212	AcroRd32.exe
2212	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\be55ae37252e82c20339ad448cfe3755_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bcded84d226c7ef73178206e5f6317e6

SHA1
708cf5f076e76a749fcad2a96954e7ed08771a48

SHA256
f8c98c09d4a3b7cabf41c277058e58e65017961dc5e66485672cb1de9bb5552d

SHA512
e1fdefaa1f7513c9603a7bf34a79584ccf122f2461649503ca3503cc06b7a59294d3a949173944385703dd09b6543013702af29b6c4779a89f75d79aa065b8a3

Download Submit