e49e8641241ab5253cfd2b4624778a413c177ddc0f24f34e1ba4e3671cf9b1c4

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b52ee4a3d8658037d14b1a98ee238f86_JaffaCakes118.pdf
Size

81KB
MD5

b52ee4a3d8658037d14b1a98ee238f86
SHA1

16e9f0ba33bc853742c0043ba9478bf5be424cfe
SHA256

e49e8641241ab5253cfd2b4624778a413c177ddc0f24f34e1ba4e3671cf9b1c4
SHA512

844ee8049e1f80f1bf72f2587774318e77568ec9af62c5766c1ec64db6eae5cf52aaf0461337ef4e37c49baa00887e9a6ac0aec0083fd143ec2c2c0fae4d61a2
SSDEEP

1536:mkEy2IrnnzIJyEMsKeRjeAc7LsbAYb6qlkjPY/6wJ33YhAOFW80+MjQGY7RF:p1nsALDeleAc7LGNGjPY/6k4T9nMjQGA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2760	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2760	AcroRd32.exe
2760	AcroRd32.exe
2760	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b52ee4a3d8658037d14b1a98ee238f86_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a1420bd366361374787472ad061da622

SHA1
1666cafc454fc38938b1fd2a0429eac5e6536c21

SHA256
56e22651da46e4c20674dea16e8afefbdb0437e5693b93dc306f21b6083d39c7

SHA512
d290be700f855b9cb48a25d60d4a1812871adc47903ef5370b48ced486a13b19052bbeb079c7f2d7c9502408c4447534428a16e4765b475ba0dd4af641e29abf

Download Submit