e80ac11d27d8567450e8000e60f40e17fe289b97b3141a7a0f51cd54dab9d0c4

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be0c87f7aa65405e1398cfa670017584_JaffaCakes118.pdf
Size

40KB
MD5

be0c87f7aa65405e1398cfa670017584
SHA1

f45e28fb1b81183333da59f5bbafbf51c8547406
SHA256

e80ac11d27d8567450e8000e60f40e17fe289b97b3141a7a0f51cd54dab9d0c4
SHA512

89e983d01cbcce45951212a7b35695a25d518135c1576b3086305ccd20409365acfe2f053f226407ae86dea52883971af89f5b34296157673f84f1a5b4636f64
SSDEEP

768:dAYD5BcYSKByB3+199gKgq5qGh0oOgGKnpnXPIp52vZ5xE5tXuMZmwgCLWarv/:mY7TrByB3+199gKgq5qGh0oOgGUfYWZU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1824	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1824	AcroRd32.exe
1824	AcroRd32.exe
1824	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\be0c87f7aa65405e1398cfa670017584_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c10ee03f4373f785f13338d1cbbe27ef

SHA1
02bd5f8be00c4076554052d495ab3cdbfa5218c0

SHA256
3cdb94adbe1e3ba1e33dd5cc8ec13f2a8e066905e05ad3ac4d74e5368153206e

SHA512
2f822a6b4d35e817590555c059e67921956083ba548c674a2f117c47d17224a15fc3aa6ab003ae7565cbc8d3dce6470e3328cf07b10439999bd95e15c94d4a80

Download Submit