98bf681c26338fad90bf9bb7ca3ccc497074c034b1da4856d4433469b933881d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 22:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

262ef698308c2f23e601857a7b7bbabb_JaffaCakes118.pdf
Size

85KB
MD5

262ef698308c2f23e601857a7b7bbabb
SHA1

a884e12f59f88a5d5d23ad8354018bfe8deb6867
SHA256

98bf681c26338fad90bf9bb7ca3ccc497074c034b1da4856d4433469b933881d
SHA512

687f799fed8ed4ee9f556e453269a71b6f1a382e419d9188721ba721493d349af7b01d0b8c36ce5f71bbeb7decf4efa2b31fd0744a821c251c43fec5f9b85f2e
SSDEEP

1536:sI6yDKdopwQu7+BwblbJm8u4WCYEJxAnZA234pl1dcJKCAWarMVP+YySWOpOwrvT:8yD+cwjyWJPu4WgxABs1SKCnVPVyHwrL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2240	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2240	AcroRd32.exe
2240	AcroRd32.exe
2240	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\262ef698308c2f23e601857a7b7bbabb_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7c225f0b9f5ed8a93f36a8f95487c1f0

SHA1
a1825be33e80a91d574a5337e678907b816b07bd

SHA256
1f0b348f250e7cc21df37053828f76c7cda6c513dd98a88fa81144ad7fcbcdc9

SHA512
c26dd485e8f0b4e90330c75d9c34a8e9564142728cfe2d1cc78a6646a610d24d88cad4cbdc1ac35dbca0089ba9ccc0baecb03123612828e6415a7a2ed1a15cd1

Download Submit