b0e28a6210dd3d071331983a57dbccb92a6bd981a4c0fec188d7f7e946f6561f

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5720ed9014a755068c5321a27d286978_JaffaCakes118.pdf
Size

86KB
MD5

5720ed9014a755068c5321a27d286978
SHA1

b60ee2eedb104626a5d1b9974da007c51b2dc633
SHA256

b0e28a6210dd3d071331983a57dbccb92a6bd981a4c0fec188d7f7e946f6561f
SHA512

f638af136f993f3ba307c35976d9e8ba960e47195a91b35450506a93addf3faeb8b95bae2dc542acaac347f2e4644904e6af8aca1ccf9d3410da8dfea6577c04
SSDEEP

1536:1ETpD5xxUKROZoCX2w5AKfVYfIpEsN0osscV1FuRlodHPywd++3R8L5KDduoVsBi:+pDbaKR7CGvIkkEDoCmadHZdbeL5KDd5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2972	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2972	AcroRd32.exe
2972	AcroRd32.exe
2972	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5720ed9014a755068c5321a27d286978_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5a022add0effc933b4f2bb03737110d7

SHA1
0f14a063b850a4403d51d6eac0dfebabff641844

SHA256
5d25b59a61a7c8d9a292f3a9839bba4198ba8dc317afde47e8a6cfeb6e628207

SHA512
0a79920b2ce8cf6a2f1551ad6f5b6b05987cb13dadc395cea1558b21e9379c7c48100c6b070a05f04a3445a799b993f92897d87e7fc12cd3f3a102a049f4acca

Download Submit