b315c2b530c5ccb7c0547bf404dcf135b538ee180c84637fcb6e059b17c26238

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

008c948196c9dab8391a13d7c4134dbd_JaffaCakes118.pdf
Size

75KB
MD5

008c948196c9dab8391a13d7c4134dbd
SHA1

3b567dfb42ac0e9ee523a10da8219b2e53e8758f
SHA256

b315c2b530c5ccb7c0547bf404dcf135b538ee180c84637fcb6e059b17c26238
SHA512

5c18cc2ff8bfb8e4f135f77d6d95322e63a378d1bcf4d81cf2810fc65e4aea734a62e8338b4ddb1f0fcaccd1486a3b521a4b8eb5f42f59f63e531e564999ac57
SSDEEP

1536:1u1sOwjr5cyny2YYm2NIGRAobNROpHipYwqecKF:CE54/G1bNOHi7qej

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2920	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2920	AcroRd32.exe
2920	AcroRd32.exe
2920	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\008c948196c9dab8391a13d7c4134dbd_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ac95e49b0768da5cbdf729e5d4edb525

SHA1
7257c27a12f3ce6e659a1181265aff067f20941d

SHA256
a0afe46f792742ee7cd28cb7afe3bdb4d37f78c6e6d7f1da9c209fd752fa87c5

SHA512
8aceedc61006cdf6874fd917ec4420eb0dc9ec8a1d21f5f8394d136c59265170838862f8f5f4199475420aabc3299eac4f36579722e5546cc5bc1ef1b2bd4862

Download Submit