87c58a53721b2a411c6654446deda1abf7ec54e956ca1a3a05558bf503b2b79e

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 11:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

be8649af4fe2f8ef7e0a13c251143687_JaffaCakes118.pdf
Size

219KB
MD5

be8649af4fe2f8ef7e0a13c251143687
SHA1

afe92aa75b7226e609cddbad8e54142f22f8ba23
SHA256

87c58a53721b2a411c6654446deda1abf7ec54e956ca1a3a05558bf503b2b79e
SHA512

c7b7a7240fdf57770dc1827210a03016eab50be09d78edfb525c668628217f8364427c9456cd3c4ca0c0ddb56c53f5cf313807a12ead3346625e8f8e5b5555a5
SSDEEP

3072:cFQukXq0XwPJW0nydAZbBzp67TPn5Mirf97x4bCybMQhHrQxZqFr5W2zTU36u3Go:Ug3IJ24zqRMiL9l2bMQ9rcZqFr5wKXo

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2076	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2076	AcroRd32.exe
2076	AcroRd32.exe
2076	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\be8649af4fe2f8ef7e0a13c251143687_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1c9024678e5a94d1adf05c29532b6512

SHA1
8552f3bed0742cd057d8d1328d7d0b1c0f108463

SHA256
b819168c6c233c0c7c5774df052b3114314a0f99076202f180618f769da7cf98

SHA512
769ee75bac7925a41b0b0962eca4469101073cd1f12e5b2d2eac726bfe2d92a8dd07ff985a9d103bbb9caa3609ff6af8afd80edf11387f722f293a73f0d65b2c

Download Submit