8b2e03b8a20995c42f1918e3b1b3f18b79b4baf6a0b23de2f771b10ac55eda86

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13ec272b7662c50f6d185abc6349c966_JaffaCakes118.pdf
Size

72KB
MD5

13ec272b7662c50f6d185abc6349c966
SHA1

ecfc9f33329f919fb6e9b6ad475f3b32410e957c
SHA256

8b2e03b8a20995c42f1918e3b1b3f18b79b4baf6a0b23de2f771b10ac55eda86
SHA512

3b6d6b5cf86757f402edfe570a1dc581a8c06f786f6b6b0e7f044d2d116c32b766f5c5801ad0befbf868aea5d39028df0689df4ab85573204f63bcebb2448890
SSDEEP

1536:+BILNyTEUi2+EcmXw548v7KkusqcabpBi8J4cHm0H/0by/5oRllQHcW:fLQTEd2qmX/8TKJsR+i8J9G0H/0e/5og

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2136	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2136	AcroRd32.exe
2136	AcroRd32.exe
2136	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\13ec272b7662c50f6d185abc6349c966_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
409a01eb9d94018bc7d676f405f30828

SHA1
4096fbddc9c1c92de5a564c2edd95584de6e302e

SHA256
cc7fd9a1e6495cc8eee770fe9c4932526010f16b97e776921177ec45edbcbae6

SHA512
934da928b3d77ee40e5781e5308bec1ad4441b0ed5c0798a7826472e145af0351b60908839ecce6e207968b96e7468c82f597f7c6ecd51aaf4cc0d0369947b0f

Download Submit