990e687c150755cd61da969a839a81a28d3c33192732de87f82ac9788a382fed

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2e9f350aff963a1161fc33e5e2a57c5_JaffaCakes118.pdf
Size

69KB
MD5

a2e9f350aff963a1161fc33e5e2a57c5
SHA1

1100b3c527000d9cfeb845d1d19eab6f42970c3f
SHA256

990e687c150755cd61da969a839a81a28d3c33192732de87f82ac9788a382fed
SHA512

1191f4fafdbf54c639032fc79c3c36886de5414bfb853c6ac7b6f5b346cde7bab753246b52dad0b2343a296e33b56555aff457d788fba3d69e8c06c511ac88f5
SSDEEP

1536:/qLe1vW6u+5awB+AXNQ5IO8Qy0PX+X1QIlbjccLMUqWs8Lv083aOEn21H:ue1u6taHcK8Q3uXSIRcAbKOmUH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3016	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3016	AcroRd32.exe
3016	AcroRd32.exe
3016	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a2e9f350aff963a1161fc33e5e2a57c5_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ce20dfd566296e869119682077a8963f

SHA1
499c9814f2a6bb1020bd14ddfa0119d036bb582d

SHA256
725de5d5b7c48107e87bba244e9697658a8bbf9a813a252567df979f85e2f593

SHA512
ec08d2ad0033c3fcb7af33d0878f65adf9bc6f98995bc500c5e46d28151da0e661b649f26ebcd14acf32acb99501895e2f1f2640015675632c7abb6a05709db8

Download Submit