9e13a80118e10b0b95347f4d687622aaffde9344752793f05a31fb601617b445

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26-08-2024 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1fe303ca68a9a7ed74708480c184b36_JaffaCakes118.pdf
Size

36KB
MD5

c1fe303ca68a9a7ed74708480c184b36
SHA1

fc7039e3a5d0372ea62db53b596ecd3d0dcac3e8
SHA256

9e13a80118e10b0b95347f4d687622aaffde9344752793f05a31fb601617b445
SHA512

f5740034323ece6fecf6b8e968cb83b167aef225367409300f4c4a4f68e7b8ad1f106e7df38bb8da9b498fecf94a497e78e09694a11c0d20536f9e27e397a159
SSDEEP

768:RxgCGBwaih1VPOVvGnmausDQ9a/FI2DbQGZeORSE5fXuMZmwgCLWaroF:X4lih1VPOVvGnmausDQ9a/FI27ZeORjK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2868	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2868	AcroRd32.exe
2868	AcroRd32.exe
2868	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c1fe303ca68a9a7ed74708480c184b36_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0d07f1b97143075ce05af1be89a56d6e

SHA1
de45aae1e4bdc0a98a9d9d67f6a9a7042cab2524

SHA256
86ec8cf58ea7a864b63d96e78b0aab364a838fe5448e7dbc0d0507a98a69dd38

SHA512
1538fe54717801da68df65b5ba9aae8d8f17f89e7fe066726e2eedc618fa361d82b6065096565218edcae6dc138f0c17679cc29070ed56522e5cf99207abb226

Download Submit