ba72af6c2bf02d76a15d8fd6ed22353fa25b4c9495c9d6839cd0b7ab628c31fa

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

256ae49460efc700c55166896c960a81_JaffaCakes118.pdf
Size

83KB
MD5

256ae49460efc700c55166896c960a81
SHA1

e670a75bb0ecce6b458d068f42247cdc0389abec
SHA256

ba72af6c2bf02d76a15d8fd6ed22353fa25b4c9495c9d6839cd0b7ab628c31fa
SHA512

0c1c1827bb291e0bd6531f257b53a63c86f4ccd097f88d1bfd6f13bd262641c246639863f047ff569b0827725185b20270422c939bcca316e1dc225c8665cc56
SSDEEP

1536:bAtqYkymgFb3AT4Ic4rE9ewUGem2SNx4vwwLebvI5cgmmQ8jeW1za9d3URh5HWB9:0/bmuDATA4fFGem2kx4vwwOvrmD+Vqh4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1992	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1992	AcroRd32.exe
1992	AcroRd32.exe
1992	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\256ae49460efc700c55166896c960a81_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
aed2b7b90987721bd826d006a71428c0

SHA1
e4bc7270675fc0e5f5b4e58c5d177c76165f4788

SHA256
745b6f53ab711f2b19afb7148355181cca5795f0a3dd4793968901f4f37ef286

SHA512
1d6378924d57764fddb412a9076c330dc192eb639291f576d336d91d380a3c74032b160b5fa6545c5a86b716318cfaf0dd095f741d0323728f28b48c529b9d63

Download Submit