f0c768386f72e175e65693193d4523599dddce42be53d3e3de87a8e73cdd1434

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e014812d4317f9eacf693bfcff3ac659_JaffaCakes118.pdf
Size

72KB
MD5

e014812d4317f9eacf693bfcff3ac659
SHA1

3657b2ab177b53fc4a722855bab1273c37ba39d4
SHA256

f0c768386f72e175e65693193d4523599dddce42be53d3e3de87a8e73cdd1434
SHA512

ef6e8656d79fa68dc3c5ec2d60de0ff010ed6de68056536c1b86db6ae6c19bf4e8900cab56a6217002ce825b646308bec1fe44cfc86f75daf61cf9fb7693aad9
SSDEEP

1536:AmjkKUWJCNg4hLJHlAilVrD43Yn/1meLkr47CfCC4Ez/BfWlp6DrWapOnQSs:do0JCnlbrD4o/4eLk+eCrOB8p6DUne

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2348	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2348	AcroRd32.exe
2348	AcroRd32.exe
2348	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e014812d4317f9eacf693bfcff3ac659_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7e973bd653bff391fc0dc8a31b7a2495

SHA1
a8c0ef712c4893446d943dbcf972d0fc999292e1

SHA256
96fd1cabc85b464584c4241b2b5dfefde04f10f8bedd92d64df107a4e1635196

SHA512
ea93cbf3049d4c0e0cf6061d399290f26a19d83e7edec6e12b52777802d88bd2057285dacccf303bb68e7b771f6f7d6b99201f44938ab042d89f38941e297cb2

Download Submit