977b6bbd01a3ea016806f63062431020dc1d07451be8fdfbc816f457c9fee916

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4f6581f9c0f034e6a3e8580eadb6c23_JaffaCakes118.pdf
Size

76KB
MD5

b4f6581f9c0f034e6a3e8580eadb6c23
SHA1

105c174f941c823eacd815d295c7454a8295273c
SHA256

977b6bbd01a3ea016806f63062431020dc1d07451be8fdfbc816f457c9fee916
SHA512

cf4a13efaa4d5b9793671e570835799332e8a5069d44caf8df23f8b821f5072f9bc99619dca231e9ffebf024bbe1d134da7cd3564a6c671e11b4c0fa4d816d6b
SSDEEP

1536:1XXdsrW6v2jdBbBxsmDOy9GDEspIeUdYzP+xWkNpOPKHrZHY+RdVZmdW5gQITXv:Kv2jd1soOhDEyUd2dPorZHYSZhIb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1892	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1892	AcroRd32.exe
1892	AcroRd32.exe
1892	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b4f6581f9c0f034e6a3e8580eadb6c23_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
98bd6fac6f6d7012a466909291f78163

SHA1
191fea7198f2cad48d30464fdd42fad398903e2f

SHA256
518888fc620c8f7ba15a1c89010ce0f41ebffb054b8c1c116c6d929107a244a0

SHA512
7f631d912c2ba604766b288ad393b2ab0ee10a119b4ce8e94588d255810db63a5a8c62b4ce108860d716ac13f1db232d03679e51f424da128bec6a1cefec64ce

Download Submit