bd07d1b855e555f325e1eb27b4cc404bf1d57e3d1984da98f4f38b01f613f2eb

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bea6a90dea9fafaff74778c13e621033_JaffaCakes118.pdf
Size

38KB
MD5

bea6a90dea9fafaff74778c13e621033
SHA1

632baed893403500f51fc88eb781a3ddbf91ab10
SHA256

bd07d1b855e555f325e1eb27b4cc404bf1d57e3d1984da98f4f38b01f613f2eb
SHA512

35874218276d62a1614bea87def86eb43c7a2bf01f8b340deb52992d4d2e5688dc46cf2214aaa9cce6f3505007b8692d566cbb81673ac69b75bac15bbde60724
SSDEEP

768:2UA6ZDHho5Lob0VKxV20HbQ6voeq+JB2W6A05:2J6Jq9H+bvvoDvW6Z5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2196	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2196	AcroRd32.exe
2196	AcroRd32.exe
2196	AcroRd32.exe
2196	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bea6a90dea9fafaff74778c13e621033_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
401bacc7c327ef0c382a005f9589e186

SHA1
9fa4fac9e88686845fea48312fd55a38accb5714

SHA256
73b325a8737f5b1f75bf58dda406c01ef8a3bb8b26785f26443af6faeaa4c165

SHA512
75d14ef0ff00daad797774ec7ec84a4e3b4be61379bc238b88e962828c4e441cb3715cd568c7196f7829430050fa3d0fc2bfe68321ba10712d0df75f5aded45f

Download Submit