b121eb72a733d41a9f8b9ff7c6fbba2aed2c6f4d1cc09d380c4d468a10d731ec

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d33830cb78a36e569dc2a63ac7e43ef9_JaffaCakes118.pdf
Size

42KB
MD5

d33830cb78a36e569dc2a63ac7e43ef9
SHA1

c83705657231ee6f88e1d7ed6f1f5936331b1c65
SHA256

b121eb72a733d41a9f8b9ff7c6fbba2aed2c6f4d1cc09d380c4d468a10d731ec
SHA512

3ae4a75d2079a08e173f18b9e61f583b424f66edb8324cd79425bbb22e76876f57d52d2e7aea04871e2c4534b5febc3418352989eb9c4d0d5e579231549b93a9
SSDEEP

768:4gGzpD8pv1d9NclH1ERdFawiN+5c7G7iAMQLHAT8dkGlmaGqdooYrU/iT:VGFYpvmwca+9QLgYlhGfoF/iT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2328	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2328	AcroRd32.exe
2328	AcroRd32.exe
2328	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d33830cb78a36e569dc2a63ac7e43ef9_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4f94cf7fb27aa15b629b7c9febe3d966

SHA1
bc5469dc7a7ac1efc7244b45b396f3c31fd12f33

SHA256
60d68cd7fbee4a731e237252c14bd8ca542ff68488dcdec1f633354abe60a816

SHA512
1d7eac507adab07201cc8eeab67ca5f4aeb1e778ded9b08bfbdac06dbd738ac1f1e6d7124b96f9b22d9d7b7ea0f8e841be3ef71f3afec4b0c145dda4f0c5d471

Download Submit