071bc48d4a46621b1ac6c3dba6cb6055fb280f10bfd3b7f31aba0eb486a44f90

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

becc1cf980e16f46b84b41c40f11a4fd_JaffaCakes118.pdf
Size

36KB
MD5

becc1cf980e16f46b84b41c40f11a4fd
SHA1

073bf82cff69ad31f1f84efed0e67679183c0296
SHA256

071bc48d4a46621b1ac6c3dba6cb6055fb280f10bfd3b7f31aba0eb486a44f90
SHA512

50122151902561af8e7909a1bbd4a4b3a69b833ebe8230deb4d95d6bd2572a920f61245ad2d6b16b4a0135930596d01424c71a56dd6968672a06bb0040aa96e3
SSDEEP

768:UXuMZmwgCLWarJy1x2/VwePpUtTFQ8gS8kULMPxW66BwktNb:UXFZmGWSJy8VwUMQ8gTNAW6tktNb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2272	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\becc1cf980e16f46b84b41c40f11a4fd_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e9daa9772a547d1f05a4139a08dd8783

SHA1
080dc4bb747ba9533fb57687535ff2e0c25a935a

SHA256
fa5084e355def062ba9f12e2c14654199106cca3dab4be3e4dc02d780f597a50

SHA512
4f7a57ddee6f1579f31bebbdac0ca25a94ee84f4300ac8e1dcd0dba25d342c4071fe29bff4d629827ba67d6816c356c4048183f0c5efcde9b76d01dbcc48416d

Download Submit