2d25b8197da1de2bcd1753f63f3295c57c1b07d405a4c3dfdc70d5d2f0eb4833

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2606a071f2e249f2d60ddb0a8b6d4278_JaffaCakes118.pdf
Size

73KB
MD5

2606a071f2e249f2d60ddb0a8b6d4278
SHA1

fee960fb5978ec17ebeae1f0d891ae283bc72dbe
SHA256

2d25b8197da1de2bcd1753f63f3295c57c1b07d405a4c3dfdc70d5d2f0eb4833
SHA512

3a49a5844ffa35ce7c2b22da1ea96643b4b8c90ef840ddedbf2fd0766175f6a84d7f8e21eb16e10e48c44df719f4f56674bf73e89e437d494143feecb90df777
SSDEEP

1536:FNhjYYnNvd3QLx0/i6VnaZ29ZUHaYC6l4M0WBIAENj0U76w5WApO6FXb:fhnNVsx0aVWGaYC6CMtXm04g6N

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2400	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2400	AcroRd32.exe
2400	AcroRd32.exe
2400	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2606a071f2e249f2d60ddb0a8b6d4278_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f8a26163a46b50b743f7b38abd8c111e

SHA1
14f1f471ff67b675e33da0f536b1fa6f1d31315b

SHA256
76fa0d65d20725ef14fdaf736b37b1169a0e471d54b0cc2121cd6bdaeb80823c

SHA512
99a34c0db79e52ab5dbdaf7f74145297624a862f6754d48a49ea41faa8fcc3bc19c250202603ad4c8a8cb7442fa7b33b9bbd4cbb3d6b71d466a0355839dc0ce4

Download Submit