c33702e5b920804f0703a63e952b2ad7750e9d665367b061142d8d0b9653ba2e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 11:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e01fabccce99c1786152cb9f66d585f0_JaffaCakes118.pdf
Size

46KB
MD5

e01fabccce99c1786152cb9f66d585f0
SHA1

6c693d39ece0c5649fe9b44825b36863e806ddef
SHA256

c33702e5b920804f0703a63e952b2ad7750e9d665367b061142d8d0b9653ba2e
SHA512

e0c1a05907f53fcd5accbb02666d7143eef45e4bcd5622946c8ae427844726fa65151c8272eacd713277ce2cc157f7d094c2d9de0f977c6155e78d0c775e92b6
SSDEEP

768:gGuxKU/9o5bQJaODOBRmW+4HwmNYcUGKSx2Fy830PitmivZoqMq8jcE0HZRXuMZU:gU3NuaODOBRmW+4HwmNYcUGKSxD2Ou78

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1708	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1708	AcroRd32.exe
1708	AcroRd32.exe
1708	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e01fabccce99c1786152cb9f66d585f0_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f872af63218ca0aabd5d7b84c2a224ab

SHA1
c1cd86bba15197067a41f13ef041e18a4c45e63d

SHA256
85e7f4c0f1930e50c673938862eafec226752381a85c6f5f37e915786aa74885

SHA512
2ea29cce391ec04e77b7f0708ce5baad3d6c52acca411d43e302fd918bcab92c758c805d201b23606e2a00300c6f482a39eb5d45adee6e5f0447e8e5838d654a

Download Submit