1bf1a70811154f8e03709f1b2a4eabdcc46b1a3a896d7ad9f69617553361b81c

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f2185679efac42eb30ffc2167b30b40_JaffaCakes118.pdf
Size

71KB
MD5

2f2185679efac42eb30ffc2167b30b40
SHA1

f4d1b4eea59a363f7ce71ac49dd55252a0e19001
SHA256

1bf1a70811154f8e03709f1b2a4eabdcc46b1a3a896d7ad9f69617553361b81c
SHA512

6391d2593d3ac88a173f623eb4f409d53cb0a8571cbb5b45979cb67bcb8d3f32b0b2471d4aa9fe79e414aa62efc2c7b93388c2b553064c6bbb5a1e93a3b05c86
SSDEEP

1536:YYfGqxlOFJonBZ6chfR62IBapuGe9SyQfRu2uyg1p0pPapc:/fGqxlOHoBPfElapun94nG1pUPz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2060	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2060	AcroRd32.exe
2060	AcroRd32.exe
2060	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2f2185679efac42eb30ffc2167b30b40_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
661d8fd27c17a302502a97938d5d321e

SHA1
9801e137dfdd518fe39e1f87d63fd508dafe4d98

SHA256
5d96cc42ae618791ede0b1c52a3dc1a423fadc61ad7629eb557dee21566b084f

SHA512
b0f4a6e30540f7cb5cf765a5def1e1147e5c71dc8c48c4796a35503710b25b0095833b73497a7ec325563a512f2940068f4c57b1df40635cbe9b38aab56bf778

Download Submit