badef10e171fd24433f9f7a5472b9978053b758fce6a1b6b7638edf04e6dd6ec

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

02a3b2da6ed341163325112587e6be6f_JaffaCakes118.pdf
Size

76KB
MD5

02a3b2da6ed341163325112587e6be6f
SHA1

71f86fe663912458832b334baf263678593abe20
SHA256

badef10e171fd24433f9f7a5472b9978053b758fce6a1b6b7638edf04e6dd6ec
SHA512

ae9a08f52347a06d57049410ec83f1690f60162eaa1aeb3fc80319b96ae5834cba964680a143fe2cedf560b42eeaaf4cfa91b3772907792be5b81e95f50fc4ca
SSDEEP

1536:4U6YVvf5LhGaMoTJgfvvVylEztA5MFJWInYkfPSWj1jrOSjqrFWspO2XE:D6g5dzp+XdwEztA5M06SWj1jrZj2s2U

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2480	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2480	AcroRd32.exe
2480	AcroRd32.exe
2480	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\02a3b2da6ed341163325112587e6be6f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
067c368ae96f65540c6f5283be3bfd88

SHA1
3f5291b0922793c4a7cffacdee72245399a7fd6d

SHA256
76ea0b0aaa5184fa44c2a8f6fdce037720708134a6acc1972ac3a942945c0864

SHA512
b5bbd630e3e4a224e76fcb84f186db484f27bc8dc7869f949c158d8116d761e9bea2d01eeedb9b6c823819bd037c88fa2196ece28770cef8717624ae3b91ee25

Download Submit