b0fd7515a132fe88a574319eeb286b00df7eae553e0c42f708342a55d0460027

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf267c1ad1b378a00333cd99af3dfd53_JaffaCakes118.pdf
Size

41KB
MD5

cf267c1ad1b378a00333cd99af3dfd53
SHA1

39851a25eae793a38e8356c3ddc55dc7e123b9f8
SHA256

b0fd7515a132fe88a574319eeb286b00df7eae553e0c42f708342a55d0460027
SHA512

445fd6f2c034ef14da99f9647c08370d2f12f3ee3c3a9e2d1a510546eeefcc5fb5550d66048cc012161d4aba1266531f38920ce65c36fe43297a1200851db144
SSDEEP

768:jKrGPOggBmGyUBvUwzGXxmV2nyuEMSXD/ezaKmNMk3lS91WJKE3VPOr+TC/ulKl/:jbPdAdp1QmV2nnSXLezaKm2k3lS91WJc

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2156	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2156	AcroRd32.exe
2156	AcroRd32.exe
2156	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cf267c1ad1b378a00333cd99af3dfd53_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3f6e78cdfbbf21144cc47c0d3b4045fa

SHA1
ac4c7b7b18aa5730a052ba3dbcdc37b38c042860

SHA256
d4db8f8f566603eb1498aed43a06243baf8be924ea1ef76541d0edb9ef79a420

SHA512
456fa24d60ec0cd4b5175e4f75a5d47ee644ab175b7d95586cc14d5282c4c18c728dcd58c40053f751bcfb85bf493476a35a0a2cf3e7e52dac27b2187ee74fa5

Download Submit