eef8e02837ecb759311ef335723dde4d9981defaa86039dab8e1131a4064ddb1

Analysis

max time kernel
92s
max time network
21s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

866a98dc6ba44ca573f1b454488aa7a2_JaffaCakes118.pdf
Size

75KB
MD5

866a98dc6ba44ca573f1b454488aa7a2
SHA1

dad32a2996f330e51a72f609e94e027947d3c32d
SHA256

eef8e02837ecb759311ef335723dde4d9981defaa86039dab8e1131a4064ddb1
SHA512

327d9b124cc951ed209b8715af68efad5e49a1ca04dee9d9d47b5d6edd35974ad0fdace9306567f4a5c2e8b086fbf7afd16dc0df9dd224984012a5fe0256dadf
SSDEEP

1536:euyosB8l2VvEPAWzHfJlRcZvGJeiLndi2B4/vkcMvFxW+WWgifMC4ZSyLXqhWQpS:xZDA7QJLcdGJeiDUe4HSQWfMCNyLXqs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2612	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2612	AcroRd32.exe
2612	AcroRd32.exe
2612	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\866a98dc6ba44ca573f1b454488aa7a2_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d37d373ac9108183dee3623bc96e6fa7

SHA1
6361310c2775b9b8954047f3d0ec98d00dd0bd15

SHA256
cde93056fc64cf385181ce8fbbda2fb375db93fc6a897194fd393eb1579d006d

SHA512
26de0c2e088e1245aff163cb3f13573aa3fbcf596572fc61bfaae7ea68fec98cb91e18addafce9ce0849fd0dd5283a37b57cbc64684ca8c7cc64d302e3e90813

Download Submit