eb6a739a35e779981c9f0a15e5fdd4b7c03626c6d51e1cba8ab60e6f4b1ce91a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0308e4745e32f644713633138c38194_JaffaCakes118.pdf
Size

43KB
MD5

c0308e4745e32f644713633138c38194
SHA1

21c17ba24459d191efb2dd327745b7f0151ae8bd
SHA256

eb6a739a35e779981c9f0a15e5fdd4b7c03626c6d51e1cba8ab60e6f4b1ce91a
SHA512

378094896c812522047af379c7f65359f57ef4acfd08ee795e26613bb3abe07d709a965ddd3f72144f4dc3fb21d47a229699c31f452a4679d1cd6ef43f172437
SSDEEP

768:5gGzpD4pyfT+vbXc/12QwXruB5x8T8yBX06rMk2boEnd5x5Wru8CVqYgByYC0bXl:6GFMpyN8AGk6rv2bFpWru8ZYgBPbXeq5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2368	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2368	AcroRd32.exe
2368	AcroRd32.exe
2368	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c0308e4745e32f644713633138c38194_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
343096155561c3185dbbc6967c57a69f

SHA1
f5ec823df2d73b292c93e51ad24def8bd43b7e82

SHA256
8070f1aab4f90db4589cdce54f5579b15b260d603af8885d9dc9c9c1eaabdc14

SHA512
1061f421d89320ecdcb92a4f9bb85094ba76fd9397421a084dc35a89296c8b2728169b8476b3073924e3a15f77d5d68575526f83c02ff1614f0cd99d6e088d53

Download Submit