3034aee2c8ab3d83576d8696dc3d87f9a64774715f2544bbb1e30993a3276a7e

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8e6a6987be4008b5247605e6dd2ca94_JaffaCakes118.pdf
Size

44KB
MD5

c8e6a6987be4008b5247605e6dd2ca94
SHA1

58769b3d24e5d19614e80fa3991503edea8e6de2
SHA256

3034aee2c8ab3d83576d8696dc3d87f9a64774715f2544bbb1e30993a3276a7e
SHA512

9ef2976c0e315f28655c31f6441d43ed354dcd7e6240b989593a2252ffb099b1bcb42a6124b256369e9a36311f07f648349f1393f9bdf5c72552c91f56193913
SSDEEP

768:bgGzpDijbu2tnYJ4EuI7vw7CkUoy6YrM2cXPM/o9RCZDHci5Q+O7qT4eS6kG+:kGFmqUCkUF60SM/gatuReS6kG+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2056	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c8e6a6987be4008b5247605e6dd2ca94_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3f38888d023bbf45602438e2f29ac53a

SHA1
9236f1731eed1357502ad4be06ff2e8a4b0fb88a

SHA256
c75ee9390279cc25862b7d44b0aafb6c98157874b908d65ea0bda2b50f8a6414

SHA512
f48946c1195c3b22c2427b3113c492f49483c36747cb14c9c809b78a087913556ec900bb81a26c1aa3470765b84e7689824578943f0ad3db5995edb9dd8fbd5c

Download Submit