6ab3ee2d5010225177e3beeb0d3f6edac6c00fc6df8d13984d112cf431be46b7

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be61410cf646cc6eb5665d073a1901dc_JaffaCakes118.pdf
Size

43KB
MD5

be61410cf646cc6eb5665d073a1901dc
SHA1

68b178bf57aa65612813317d82f0ae1fbac5b6f7
SHA256

6ab3ee2d5010225177e3beeb0d3f6edac6c00fc6df8d13984d112cf431be46b7
SHA512

9fd0df4e2d42475190f9946acbd8f04051fb98716fd2bc8746ae2062a300833acdf01e8c6175038bae1b4226b622c25c8d3c42f6f99c1ac8b63146fb7d7f0a1a
SSDEEP

768:cXuMZmwgCLWarwAE5HpxJnu9Rd+90y3qptCQQtN45NX3kqXxgpa9tyL+gPJwLDOa:cXFZmGWSwpjJnuHd+90y3qptCQQH45Fn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2680	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\be61410cf646cc6eb5665d073a1901dc_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9f91ef432121eb6cfd8133e5a5e5121c

SHA1
1f17e990b408887bb14e68b45658c0acac49d98e

SHA256
ca43bb2dcb11df899c5d79b4fda96a5265c614cf7cc8bf6aa22009c077a99118

SHA512
29a7b6500b95ea5cffe742366aa15cdce948e5b2b6dcc697ee2b0ed60fd3cf3a5d5f5c9ee52c6e8139addbbcd98358c9b58e76991700f30320e211bd3bbeec2c

Download Submit