95225ef3a75091db9a0db0282dd06fef1bc9b10ab900fc3603749ca947b2c662

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e004109cf68f8c6c7f4890e381a3c405_JaffaCakes118.pdf
Size

89KB
MD5

e004109cf68f8c6c7f4890e381a3c405
SHA1

b56e0fb3a792fd6fba05305634e07fb615b002b5
SHA256

95225ef3a75091db9a0db0282dd06fef1bc9b10ab900fc3603749ca947b2c662
SHA512

f53be3cda2399427cc6f03b2cb5814c250c56885b0ce00b567e50e764fcd19d8365430a899cd31ea896ffce20248602fd5858fb1b9ee2da174ea9530e8af22f1
SSDEEP

1536:3zSWH6YzQ0JTHzJoEtXKA4+o0cKX8Jm9tvxcXJ18AeaqOYWuOAxweFNWcpOmgES:2WHPhTHzJoEpo0cKX8JUtvEQAeBOVAx+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2612	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2612	AcroRd32.exe
2612	AcroRd32.exe
2612	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e004109cf68f8c6c7f4890e381a3c405_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
df8da37bfeeefdacf7cf368d666e5687

SHA1
57a253cdd88fee70f1eca0c29d4fd385785545e1

SHA256
b0b0065d18de05a250aed3039393e7ee068677b2199d80c3a7f846ca72282083

SHA512
1ecf24188a2482e1fc1208a146625810e6997d2efb99caac6f36f5d9daa85c2deede4d82620cbcffe7fa77246e08868c070e53827248f004c2d090b27ab91ac8

Download Submit