d8bc83b201afd7fc657da18a2e7c8dd4ee591f6dbf54e4dc231f59ffc2c094cc

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 14:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4053623ed220570850f0bbd6a1cfa7eb_JaffaCakes118.pdf
Size

79KB
MD5

4053623ed220570850f0bbd6a1cfa7eb
SHA1

10d71371eca9723e628f551d2447def242fe1df9
SHA256

d8bc83b201afd7fc657da18a2e7c8dd4ee591f6dbf54e4dc231f59ffc2c094cc
SHA512

a3a608740572015bf3dfad140ab795314ccf59c944cc7c221ff8b5f8bc796b9ecff9fb234f5962899df8e58d6d48c57442f09d7efdf1b707cd79da682f03f399
SSDEEP

1536:LNYe/HnFRI8rwMyGx3BcqEZIt3lyxry3nnurnKAoGNAVs8kxWXGROxuTi9jlvH:Cefnc8XvcvY3lz34Hx321x

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2012	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2012	AcroRd32.exe
2012	AcroRd32.exe
2012	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4053623ed220570850f0bbd6a1cfa7eb_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bcbfb04dea00aeab9d7a839d29ce24cf

SHA1
30fc41e49165b5517334ce2e7790f02393ba95b4

SHA256
03f3b234c382bc9dddea8bb60d12e12190416f6c924e4ec8c2202742db7f2e4f

SHA512
d7cb20caec567a84abe7a5fad7402859fb0f6388480128d15eb00985c65b834dd3b390149b6da5f37f8e2b86e508db0943a0208f719f32df7ad9d0fc72bb7bdc

Download Submit