e14c3389740080b2b20a7db6a474b367f7e26333cf8efbc5913bdeada876fef1

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d1369858b6452712f5b7dd78beb65646_JaffaCakes118.pdf
Size

43KB
MD5

d1369858b6452712f5b7dd78beb65646
SHA1

00b81dd992287ca5e08e9b60f3e8bbaf4f32d1ae
SHA256

e14c3389740080b2b20a7db6a474b367f7e26333cf8efbc5913bdeada876fef1
SHA512

3a544900d29e07ec9f6e8ec8f809f48121493cb4212eee4bffe8eeac4979ebb0282526823a5dc667bbc1d56fcac2525b0ecc154a24fdb8cd968fd54820abdc45
SSDEEP

768:PgGzpDYyjpwSlqw+RXbnH7iECvZDz5rtw7kqpse0RgdpgjYq1DmjCO3aSvfTpsfw:4GFcNw+Rr+EzVyRpjYSmjsSvfTpsfw

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2280	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2280	AcroRd32.exe
2280	AcroRd32.exe
2280	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d1369858b6452712f5b7dd78beb65646_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9b3a0a1228a153aa21eebdcbc2bd1ba9

SHA1
28ec9c23cd69ea1b92ec62acf9dc576aa286f47b

SHA256
ecea51a893d32a914bce162f622c96a97859c821a922326c72628dfe9bb97d28

SHA512
1076b420bc1a162fd3bf6bacc5e20f72b4cd2e567037102fcb1ef0eb6695c74e044fc7077eb0d35558980176e0c5b99c37e054ac89bc279434694f753918ee03

Download Submit