2b81324bb30c1ac3ab5e2aee3f192134668e01af0f0209569c6ccdd33505fbd2

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

070d8cb247f36addc0a105bd45d25338_JaffaCakes118.pdf
Size

80KB
MD5

070d8cb247f36addc0a105bd45d25338
SHA1

9cf632b9825dca652753b201ea07dafb56ae3c77
SHA256

2b81324bb30c1ac3ab5e2aee3f192134668e01af0f0209569c6ccdd33505fbd2
SHA512

642d257bc1ecae89de57a3e5eeaaac62b9a95c4c298720db99c10737d2ab98ba2b3dd87daf8564bae6b51fe7c611607ac3c62af88afa7f1741a44cbff11c06ba
SSDEEP

1536:zEfic1RsaQeyRG4oCNYHkFbJOiU/6o/8VaX0u1ZAKEi/WdJcEE:oak1QZRGZCNYEFb26ouaX0Wi9iJb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2408	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2408	AcroRd32.exe
2408	AcroRd32.exe
2408	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\070d8cb247f36addc0a105bd45d25338_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9b4ca00752a2f2a1886712c963e1e8be

SHA1
cc168bc9acb88c815090d99d244e9ba1785d190f

SHA256
b12f2e8cc8a2ff0270f101bd3bfd96d9191d3aabea4501be7bad6a93a032d12a

SHA512
a5e1721d8d6f8959dfdb819d0795bf6e3cfc8f34e165e4a99ba454198dc92a933f7e2a7916690463c73026522d8950f89910eba4996d98c22d13cdaa8589c1bd

Download Submit