b1de7114c544e04c7d0ed45a25506767e42b89349a67f669cd7b7f54bc83c92c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 05:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2bb209b3e2c21a97fea3f49fe9207371_JaffaCakes118.pdf
Size

63KB
MD5

2bb209b3e2c21a97fea3f49fe9207371
SHA1

4c40abe50c6ee1d95f7a2675cc619a479653f56e
SHA256

b1de7114c544e04c7d0ed45a25506767e42b89349a67f669cd7b7f54bc83c92c
SHA512

514b0c94125baad176e3918687e6624e5c3f9a2be3cbf782e409d87e8af0f76a2d15b853f2f60f29d90b4b88443ba9afd867b420936eab5a78fe0cb2987936c1
SSDEEP

1536:YH8lsQimJ4Mv6R2Rr2T2v1XzvTWWYPLJtNk/5BBIkAkh/DV:Kqk+tdXzCdOBBIkBhh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1504	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1504	AcroRd32.exe
1504	AcroRd32.exe
1504	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2bb209b3e2c21a97fea3f49fe9207371_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
973d727271d368372fd4c4d2477f0009

SHA1
477e5db77111e1cb6cb65a8ebb235f100d899787

SHA256
f8df9c61b206ecebda3f70559e86449da14a6f7669a5ba94d8230248cff8d0a3

SHA512
9094d6d1279abe86502508feb3759b24d93468b87d635ff7701e8884fec1c8457da7abd34032fd2ff1d47a00a130661c652262c76fd43a74a6eae320c84462b2

Download Submit