885a5222f0925de099d7edb3dc4adf35caf205e373ada469b08343d9e4a1322b

Analysis

max time kernel
95s
max time network
20s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f06deae7d13f11a91c767b84baefb999_JaffaCakes118.pdf
Size

82KB
MD5

f06deae7d13f11a91c767b84baefb999
SHA1

baf9f9080cdafa333c534af7df4ed3968ed24d0f
SHA256

885a5222f0925de099d7edb3dc4adf35caf205e373ada469b08343d9e4a1322b
SHA512

ab9f5f2b6213a7e11c06b222bd160836cb4a2d8ab144bd9e15c005339c7ec3f91c1dbb65b99456555c12f19d55e0f893377b075f4763fedc3d9d3b61379bca35
SSDEEP

1536:bErumOCAUGpe2y4e3gBkqiaqNRmvzXWOpOaZEWubmLIee:wrum9AUGp/yOkl5izoaZSbmLe

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1688	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1688	AcroRd32.exe
1688	AcroRd32.exe
1688	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f06deae7d13f11a91c767b84baefb999_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ce79b773eb22ba51190e629f2c14f78f

SHA1
13945e33215099e20ac9a013596e33a268ba580c

SHA256
eb931fe6ed0335759b10e4a478a5af66dd76d35e9ef28525a9d42db8fdd652fd

SHA512
9cd2af2e55a2fee33416a4f107429928490053e8ca4959316a1692718cdaf2508b3a5d2d5868eeb345d2578d01daaebc67f13fa17be1b75ebac867754138abaf

Download Submit