2edf95f7b5687dd48b7dfda188543cc4d205c743850091c685f94b0fd5f09d40

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 17:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

de9d2ce7c9b1beb7e7eedadd3e7a1af4_JaffaCakes118.pdf
Size

43KB
MD5

de9d2ce7c9b1beb7e7eedadd3e7a1af4
SHA1

a426e3adc9cae60be567f466a5a0fbd5c50cca18
SHA256

2edf95f7b5687dd48b7dfda188543cc4d205c743850091c685f94b0fd5f09d40
SHA512

e62305d719be7ef806b76dd8517b25accddec04f0e94bdec803bf645bdcafebb9dd0a6d1c29a10b05227ad8221a9e5d51231bf6da63af7abce01c1f1b473ed28
SSDEEP

768:J8e0+QTaF/oGymOu6hDQBQaHw9KtruoJGMp1QvHp8nlSaUFriR8eOKDMpp49NBNq:JWPuF/oGymOu6hDQBQaXrng/i09NKYp1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2588	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2588	AcroRd32.exe
2588	AcroRd32.exe
2588	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\de9d2ce7c9b1beb7e7eedadd3e7a1af4_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fa2f01deb71e73dda4f7cd91ee779f57

SHA1
adb19a9fc01ba73443bc5784fb80269d6267198a

SHA256
92cde2d6c4f85185d1aba80d8b9ed53b209540e83098d403c045cb8efd900cec

SHA512
bf74bf2458f3114fe1b671342d500c75041ba622d219323fbb333137643160268a8f17a75f65f13de0b9ff827114a5e2ae3d6876f2e6278ceff8bb4cdd584b57

Download Submit