8f36a20f93f2476e900f0b96db2cd8850ec42346479639073986089d61cd5120

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b3557a3765ee60632439eb69e04d92d_JaffaCakes118.pdf
Size

100KB
MD5

2b3557a3765ee60632439eb69e04d92d
SHA1

58f979371e49f48e8f66a256cd3e816d82b865da
SHA256

8f36a20f93f2476e900f0b96db2cd8850ec42346479639073986089d61cd5120
SHA512

8b66a46dd0c57c6324c89c256b6acbf72aca0cd8eeb61aea4f3ed9fec7b4d4531fb18eeda1df001131e979562596221fc0c34b0e3dcda82ec3cd28ba0b4ebc29
SSDEEP

1536:Vr15s1l8tTaXlCE3ob3MbbT29/IBlZe8K09CG4GwWHu8+jfXUwRKerZ4vsbWQpOD:N1G1l8tkob/9/IvE8X4Rvs4xCvsGCa

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2508	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2508	AcroRd32.exe
2508	AcroRd32.exe
2508	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2b3557a3765ee60632439eb69e04d92d_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3eb7effac19e5ba0497b4797887191d2

SHA1
10cdf8aed09cd8463b7b9f58aa61c6b5318ba9d6

SHA256
4db09c3da0b75ed1342889d3f00149eaf297ba700d1e98f70b39481177f2e033

SHA512
7770ac4a072e26e777ea4c7b274bb1d816c79a0d0cef015cb8ddcd6b1acb317cb725398b2a289ee0e21a76720af5005aecdcd9a3251354d553e6db6c80adba6e

Download Submit