bc2559fbc9843336758f7764077d28514e6a174e5de337eefe5a8d0d766469b8

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2debf527569d3a106b1fbe4ddbf03d84_JaffaCakes118.pdf
Size

70KB
MD5

2debf527569d3a106b1fbe4ddbf03d84
SHA1

234aa196972e162a6f2742fb061ae780c263ed8f
SHA256

bc2559fbc9843336758f7764077d28514e6a174e5de337eefe5a8d0d766469b8
SHA512

998258f600fa3c68f57d329e612d2736903fe8817945e287e6515998fbeca9983287bfab76cbdb3e569dde11186f5d45d7aac0fff8d631fc077ec662c32980ef
SSDEEP

1536:btU3dzq74s6fJ8QyoHfhmle3dRZ5NwwQARglXz0oq82TS:GNzq6woZmlwdKflXztq87

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2904	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2904	AcroRd32.exe
2904	AcroRd32.exe
2904	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2debf527569d3a106b1fbe4ddbf03d84_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2740508197e5f3beaa1006bb8a427298

SHA1
d78819361b0469a41f3d20d4a715d501ecbd9ac8

SHA256
e7c7aaec48204bc1c49ef39670211741617d07d66c02184d47c221d6ead64758

SHA512
704d24840322ae90f04316ef6f9678d1ad8622ae3968f8068e4884a5f46e2a22dd7ce61b378297534047eb4af9aacee0dc8630bfb503a62c05c74788746d88a5

Download Submit