2effd7bd54eb03475ba6babe3fc9925a00004ea539b228fbfe5f596056b993d4

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8156c36cecbc40c8af54f80cfd64553_JaffaCakes118.pdf
Size

33KB
MD5

c8156c36cecbc40c8af54f80cfd64553
SHA1

88567089dc7379a8e4f09590fa45a1ab2cfc59f5
SHA256

2effd7bd54eb03475ba6babe3fc9925a00004ea539b228fbfe5f596056b993d4
SHA512

fdccb5e70e19bbcbb56f4a3684d00c5b79dd677e63e93f51d1b0398895ba150aab8d1928f49485986aaa2bba87104d2e661fd013ba83c576763232a0d334e2af
SSDEEP

768:GgGzpDGp9E8u2ixeMZnfclT4ZbGjU5sgPoPSsqWpTOnkqIQsVUOp:TGFypGnfclTzPFLqtsVUOp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe
2720	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c8156c36cecbc40c8af54f80cfd64553_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ac6a0ba8d69f5f1b9c32adc002da3357

SHA1
ce6aa563f9da2508f4dc711c0e5a28871a7fdf3b

SHA256
d0a71b76e08046f75b478f9d71a5aed8f5bfa4f2af8ef571fe092937792df79b

SHA512
86b7e429616e984e0b882791dd03625c460cf2759419e31513dc5f99d7098d97f5e838ac1066170fc6e5b412d8784fb4392f07a9243ef9d19538c767d06609b5

Download Submit