94afeeaa70268fa190d1315cea770cc6471f73b959235bb92132bad845366841

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bf4c50931c53359b3c3c7419a92bbea0_JaffaCakes118.pdf
Size

94KB
MD5

bf4c50931c53359b3c3c7419a92bbea0
SHA1

7507415f6dedaa4e9b1d4ca4ec5beb77e292876e
SHA256

94afeeaa70268fa190d1315cea770cc6471f73b959235bb92132bad845366841
SHA512

79ff692b3cac370bbc8f1fbb5655366522c49111b3d5823ec8d2e9ebc2d03ef4e3ff492585f22b0709869feccaeb37ecf7e87e5de204fd4fe7903a81aa1f72ec
SSDEEP

1536:NG/vudzr+1xJaVS52+kOoDB2M3GqV2uh5rNcBrqgUEbccqWspORGWGqhIc+:0HQr+bJaVUT1oDB2MB2kvWq9PcNRDh2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2652	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2652	AcroRd32.exe
2652	AcroRd32.exe
2652	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bf4c50931c53359b3c3c7419a92bbea0_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
58670201bcd0da5ca0b40ae351166071

SHA1
b99428a45d10a15a72c918f0f31efca4b6c245ef

SHA256
b33d8c8cdeb074fd2666cebf159d645e5246b56e32906d493c994c6a83706f4a

SHA512
6b0848a797737d57e7d6b4c61ed8e0b1b5be43fdcd7d004d535dea8347e5d1e9d6f0e7d9eb66132da00cf4fc5b0bac763216093310401a74df816a3a14fad0ee

Download Submit