e9d992b5c7d10152c1ca98e8ee6dc15ab08740fe1f9c9bcf1e73563996602a60

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 18:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

974615229ae8bd994b26e6287e596e80_JaffaCakes118.pdf
Size

84KB
MD5

974615229ae8bd994b26e6287e596e80
SHA1

5c434ef501310d581aaf7c8e1e7c9b84a12b65b2
SHA256

e9d992b5c7d10152c1ca98e8ee6dc15ab08740fe1f9c9bcf1e73563996602a60
SHA512

69afc17f8486d38fb1bd3785ae3e0d88c00aec7005b092fe6d205c49512ce7645ddd87405fbb48d40b2c9a5c44224ef1caee2a1e1332fa9b4149a0d60110d946
SSDEEP

1536:6jpeiI6lJQZPJLcRm7XpijE5ZvcQOAEuA5mFrIW80uPHPlWwpOS+iMdYq6TN:EYN+R+gUvcOA5MDuPHPMSuYx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
304	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
304	AcroRd32.exe
304	AcroRd32.exe
304	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\974615229ae8bd994b26e6287e596e80_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f698b227b3db65d1a3ddf02ce64259b7

SHA1
2ffe67e6f8fd38f7b3c5860cf9d313ea5f92bdef

SHA256
3bae6c441ef16b0d7bdcd1274aff146e25e194552412ca2224d4085f429e2b59

SHA512
6770a35a944ce1f33a380b64c616adbe3744b240f99c79c555366b92983135daf769c00a73f94a58d6f0ba34398f0374a55c633e1a17f35c494a8ef7fad9d1f1

Download Submit