0878868ebd4b16f07c86520039f888ae74de41044a48f95bd64672f45fdf8c75

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c133bc32b6fd8c607b294216b99ed6ec_JaffaCakes118.pdf
Size

17KB
MD5

c133bc32b6fd8c607b294216b99ed6ec
SHA1

94c468f2baa9ef09745358a5e63bd0c83065f73a
SHA256

0878868ebd4b16f07c86520039f888ae74de41044a48f95bd64672f45fdf8c75
SHA512

ef84c59f76063b7646079505c3f015ee0307f664fd1d4e5110e09e84f1aa9850fd4534c2bf30a0418ba81bd3923cc9a72106c62929e7f8b91ef0df96fb92b357
SSDEEP

384:VzWkq9dz1dv2Z14rBdDwnC5bc+WhoTM9S1LQ34VQIIKjdbX7IZaxDBTofvG8DoLi:VzWxvz1dvE2NdknEbVcog9iLQ3IQ9AdS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1676	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1676	AcroRd32.exe
1676	AcroRd32.exe
1676	AcroRd32.exe
1676	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c133bc32b6fd8c607b294216b99ed6ec_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e9e2908235250b9e77664f1611dca796

SHA1
8a54fa8945125b9c8043c276411a4103a9a1aef8

SHA256
c9c3a2ff4a97fdc8ae2843667fef3a83f07519f3711e816ab13406ff74826be9

SHA512
d2bcffd78a8d60fd6065787663280a5871e3cd7e2c7eb8d1c6d0b405f607efa3bf16d9221d51b7788b58a83fd98e486ac7efc7eeca034d29a418d1b3582bcbc1

Download Submit