ae665790388dd56fa3a675544b03626fb80a560fbe0bcf88c3fcecbedda88450

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfb629ed4ee2fb71c461d0c192837c7d_JaffaCakes118.pdf
Size

81KB
MD5

bfb629ed4ee2fb71c461d0c192837c7d
SHA1

0956ef2798e83b207997bd68ec99501db3a4c396
SHA256

ae665790388dd56fa3a675544b03626fb80a560fbe0bcf88c3fcecbedda88450
SHA512

2817f2859f6b1a0ac4179e774f6fb501dbf029dc4a6aea88361ac40d6a9d357ab647b6bee82844470b23ba1b5cd894174a36e323412003a26b3cc0f94a86aec1
SSDEEP

1536:soN59dc4/JrSBJxDAeds9R45BecqC1R3WajcfnQ779WapOtQE1SkGe4xJSo:D3kdNM4HB1Rd4fmCtQNesJ1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2116	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2116	AcroRd32.exe
2116	AcroRd32.exe
2116	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bfb629ed4ee2fb71c461d0c192837c7d_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ab129af74ffd59832caf45e28f6f1bcc

SHA1
f19fa708ab61455237f1daf29d0edf3e183c61c1

SHA256
e1caf76e38ce2d632bffdaa5c017ccc5264e691de7b797ec159b1ff459b6c0e3

SHA512
e94bbef18928de11c65c32b6f6b453901d3d967552a46a5f21b99e5d1b2b988e7f4acfbfb5d71fabf77296de509d931775152f50fe53408419cc43a5cbaf06fc

Download Submit