01e4cd0799a3df7cf6a2f1df53b90a1b94ea3f5d8045ab26fc2e1c4d9ca98f39

Analysis

max time kernel
96s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae584dc17a21008d3a5e533edd173be8_JaffaCakes118.pdf
Size

94KB
MD5

ae584dc17a21008d3a5e533edd173be8
SHA1

1e806239c2af17d4c5f3a8b77579673f3a22917e
SHA256

01e4cd0799a3df7cf6a2f1df53b90a1b94ea3f5d8045ab26fc2e1c4d9ca98f39
SHA512

0f6231a797968b94726bf50e09d13fb7c59b2748c9fb7b775352f73296590ff71f033657968f3090b42d574592216959f142d43a3c2d085b91fdd71b7dd14f62
SSDEEP

1536:kd1VT6oKceBGR/hVS73/Ogsy9hbObIupIE8Axhl/alWkNpOPFW3IZVBxvWp2gcDr:+1VeobeYjZIobvpIE82hl/auPgIZrxmk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1292	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1292	AcroRd32.exe
1292	AcroRd32.exe
1292	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ae584dc17a21008d3a5e533edd173be8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c1aa5fca542e9a24764241f9195f21f6

SHA1
4aeedf7366c3de96e134d57925e29d72bcced512

SHA256
5620c3ce533203ad841b86fc830b52a8465b779450ce653310dadb54493650ca

SHA512
9213678a96c4b8a268e1ed9e5ba8d885060665fc1da61803cc79c19445e94b16b5460539fc6db5296714a66e1356c07378ed2710982ce32068b8db7bdb5a6e93

Download Submit