eb00c4c29986b6e99df970908a4d088fc1194477cc40ac6a0846fc27b47d81bc

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de5ab0ed89c85d2ec65e9f63d898b1cc_JaffaCakes118.pdf
Size

9KB
MD5

de5ab0ed89c85d2ec65e9f63d898b1cc
SHA1

c73fe67d0599c647dbc5da1d59d38e8016fe89ad
SHA256

eb00c4c29986b6e99df970908a4d088fc1194477cc40ac6a0846fc27b47d81bc
SHA512

39682659b9aa0c76b7010f77d5d4af06aa1b2363b3d339b0ba3bb2bd00e02a907c6f2bdebc9d01fd990a2ba170c56e27a2345f98c18440dba0d4ec722a08825d
SSDEEP

192:6aLzsFqYQTcaZ+jt9+E/RJsY6Wy/wbgQakFGXh34pf1aJ46Bp:6GzPYQ3ZqtkEJuYULP4pfI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2668	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2668	AcroRd32.exe
2668	AcroRd32.exe
2668	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\de5ab0ed89c85d2ec65e9f63d898b1cc_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5bff538d73d07f493462ef47f47f70ae

SHA1
23a1d80f9e2870ae91426fd09e56b2a5aa424617

SHA256
bdf1cd4a04c231a71e9392c1aae69735bba637ba284ae909bec8d3abd94c095c

SHA512
41ee5b083053197eea1f75d6e2d096c3e410b9f48aa178ca4278ab65497108e255b9878cc71d3759c0021d113889dc866989d8cceebf06e408a46c042460888f

Download Submit