0b8d1d084d257348a1d170a2331ec1eb085bd90c3c3dd71564ed370f19b1f013

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f64af7d2b11a1ace02890eaba3df4331_JaffaCakes118.pdf
Size

83KB
MD5

f64af7d2b11a1ace02890eaba3df4331
SHA1

91ea60ddc7ed0f73713428a044cec76444ff0c96
SHA256

0b8d1d084d257348a1d170a2331ec1eb085bd90c3c3dd71564ed370f19b1f013
SHA512

fdd5a48f58134dac4e603d540297fd957db1a19f827745bbd184064febba568718a9de660edf3e2f8c0c93ca9e189016b1ac6d02e3a51e81863f161a43f53e09
SSDEEP

1536:Yqe+neNft5lb156FC73zvgZhOMxsBEhzFRWspO2c740kZfW5Ggyy:XxneNft5XgqvkhFsBEdO2hZzQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
264	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
264	AcroRd32.exe
264	AcroRd32.exe
264	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f64af7d2b11a1ace02890eaba3df4331_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
70a6704d55564a22299f0e9680acdfc2

SHA1
0ef7db4545f23bce6f2ada734cfd5c7352198fcb

SHA256
3c18eb123b294b676f485099ee0b0706505f13a02b8cf00854422e7a3cb91550

SHA512
f347aa5acc20ee16c2e6019533c8f60f18b9192dec4f10e39b40aab8fc9dd3c530f2af75e56a70cc67b3b52fcd6ff54a13ee6110bde8282cdaf2c7da0b283649

Download Submit