bf43dea40bbe2f4484b63e2b30f4bcf899c55b23f0ccda5b29d729e0f0e8ef32

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db5c3d7e3635cab107dc499976137bfe_JaffaCakes118.pdf
Size

49KB
MD5

db5c3d7e3635cab107dc499976137bfe
SHA1

6c9372e7ca4ba5b12bf198e8bbbd77721b81bc6e
SHA256

bf43dea40bbe2f4484b63e2b30f4bcf899c55b23f0ccda5b29d729e0f0e8ef32
SHA512

5fa587078a4124c48fcd4dd407663a4e177a0c4a5913c0ba465c03d5e8b7e8a44090acf12a8e75aac82f29835885a5b15433bc11584026bda5b29e6912c967f3
SSDEEP

768:2JiQGzPXour39Xbmw58iyhEFDnxDTAgqRsmgJdYQw+Bz/5ytJbFj2Pr1sxGc:IJGzPXR3pdDsQdX1oJj2ZsxGc

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2744	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2744	AcroRd32.exe
2744	AcroRd32.exe
2744	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\db5c3d7e3635cab107dc499976137bfe_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
835cfb618863211b552a385a2ccff852

SHA1
0aba03913baa3075ebe23e7b9aa20cc8a59c2b0b

SHA256
1cfdbe6b7183986ef1566d988572243d8570ba271988e1ac54a2a33df8b2fe70

SHA512
bbebb854b42589aea82c50df32be0077346ec1cff8435f20533c0ddd6ad487c2064182181e05750860285198055e9e778f0cd89789e4800014d08631c1964661

Download Submit