b93bd1b5cbe1f14f9fc2caf27713516b6cdd82b2aae07f2ebb5cf35535ec4fe1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf62265b9714952fe907251390a4f113_JaffaCakes118.pdf
Size

39KB
MD5

bf62265b9714952fe907251390a4f113
SHA1

1db54f93977a47c7f4d54f92c851399c94c2ab5a
SHA256

b93bd1b5cbe1f14f9fc2caf27713516b6cdd82b2aae07f2ebb5cf35535ec4fe1
SHA512

3d106c8cd5467293ef09232138334cf7128a73d227ce2b9279539ad3bfcd9d88d8ac118efa5443cd1fc779d1b1a098cc752db9f222940576b098f94cbc67d958
SSDEEP

768:IgGzpDtpIUgLE8eit5YZHNkJAFsA0Oq2i/d9JTQUsv3gQcTb49J0TJ3W5xJ1:FGFJpIjAuROAXJTQUsY1bE8gF1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe
2720	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bf62265b9714952fe907251390a4f113_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
736374c2e98aca039fb2781525214d7e

SHA1
2db9a68284b7ba842b80c6a5feed20df51ec0877

SHA256
233b5c006e70eb25ea911ff7e8575c97b527a3af0cfcc45515219aee87abeb1d

SHA512
83460e4af76f827d2bf8301e0ae407faca5c3075422248c311e782ae4d893479923d193f3c4a277fc2d9a5fc1c6634794ccfa896ffba8e412b2bc10327a09e58

Download Submit