2bab933da0e148992896c4b80cdfdf25915648fd816f5cfe0a9a9c55e47a4923

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c87e851a3c02b313b32b4e99602f8c59_JaffaCakes118.pdf
Size

4KB
MD5

c87e851a3c02b313b32b4e99602f8c59
SHA1

f14dc1d5caa034d113b813d437e0f1d6271336b3
SHA256

2bab933da0e148992896c4b80cdfdf25915648fd816f5cfe0a9a9c55e47a4923
SHA512

86afe0802739738e7fdd5786ca4e51bdb5e6e23157847536be3ae8f409d237a063a86ad2f786608606264f822cc2e295bc3b50d3206a7d5aa784e23a23ffdc59
SSDEEP

96:40G1oBwyGL5qP7dpsvlp0zi3gAkADB5Hdd2eCQn9gkiFdRpKSp:40G2myGLAPIUBwFR32Y9gdKSp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2272	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c87e851a3c02b313b32b4e99602f8c59_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c190917e7b9f7d8569a399175f9e2ebf

SHA1
203f9acf58429d55929a2064a36c4f892c675afe

SHA256
541f66536f005acd60bd5f8eb76d402c73415b14d7d06156c66bb892b09b63e1

SHA512
c426d8037cebe2671e91fd448356e0bd87160eed540e3ed97f025809f3620c98fd20d7d6c7c1d51fde6b631f152a73ad606464058ace1af668e015387740239a

Download Submit