e3f977c75c8611ee09c2470c5fcc0e7d4f8b5e9fe4159c7f437f8cb902f2b352

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a717214bb733aa57315ce76af0006343_JaffaCakes118.pdf
Size

79KB
MD5

a717214bb733aa57315ce76af0006343
SHA1

eb1922b5e1f810ee342beb13195b78c9d5226986
SHA256

e3f977c75c8611ee09c2470c5fcc0e7d4f8b5e9fe4159c7f437f8cb902f2b352
SHA512

8832c79e902681c52d8a13b0c0c974cf58d55fa9dc25a09e83c9289ffb0fe117db1d52adeab3a36dced14ef79821bbfd41b8e9413adba0daf8c6b0a2708fdc27
SSDEEP

1536:bRb5b3amTabTJWtEqm8kzuO5DC0QZld+W8LJCYNWUpO7qWmgKn5JbnlA:lCblEEqmP5DC0UldCLJCYw7bKnLu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2540	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2540	AcroRd32.exe
2540	AcroRd32.exe
2540	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a717214bb733aa57315ce76af0006343_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bee535988efd57180126a22b553a2eb0

SHA1
413e0d0022714c4fe1e965065a5501439960ea4c

SHA256
31c50f55b58a4e5544a32a8dce4bba1138e86aa8341e5eff6aff3d9e6d3ebbe9

SHA512
5ae7001bbc732de07c771d73bd6121c9cfac67c5c0ea4b0596485bf8ab63db205cef78b2839bcbd3c7d2108922aa9df50aebc8cbdd0d3c714d6527a7f7c36fca

Download Submit