2fb76feca150b94fa10efd8f2837c250c26a6cfbd9bc6424b4d7d3847d8cc4ff

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

030a1b2868c2ea18920abb7951ca5267_JaffaCakes118.pdf
Size

77KB
MD5

030a1b2868c2ea18920abb7951ca5267
SHA1

20dee48187e695b316d50c8e9845749e8df699cf
SHA256

2fb76feca150b94fa10efd8f2837c250c26a6cfbd9bc6424b4d7d3847d8cc4ff
SHA512

31f730e6981d3147d6410cd23e00e5fe2a28ffc09a2fd64d8e7bb173166381e72c85472fac2bfebd134a09a15530cdc9f68f4ccdbd314945157622a2ff7d744e
SSDEEP

1536:+/YZdUK1njYxD4oSic9EXQvOr+WtHLiWIrE+9QVw/1aD3Wgvc5d+zZjU0y4m:pZK8jYTc9EuOdt5VwtjH5d+t40I

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2080	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2080	AcroRd32.exe
2080	AcroRd32.exe
2080	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\030a1b2868c2ea18920abb7951ca5267_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2fe9aab73f745826802f5b031e0513b3

SHA1
7446beb04f6c8146293b054db98096e7be644065

SHA256
35459fb0157a4baf02984cb749c1c2d3fb49b325c9277239d14706c2a789a759

SHA512
a63a0c0768edf78997bc9509a3e834976859c89ab7fdce924d1c1c73601bcab842ec5b296e3ff4a4bca193dfffe95f3287ec1662021064add66575996bc831ce

Download Submit