91ec3565d1c00e5cbc6c301640a75ff59f8dbfa25edc2bbb6b6aace7433e12b4

Analysis

max time kernel
111s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e01ed747ebd6512ea65b30eb8d397d0c_JaffaCakes118.pdf
Size

39KB
MD5

e01ed747ebd6512ea65b30eb8d397d0c
SHA1

42ab504494dd2b021192df70e581c0a42d527bbd
SHA256

91ec3565d1c00e5cbc6c301640a75ff59f8dbfa25edc2bbb6b6aace7433e12b4
SHA512

7c6fb6589bff38324431750a4bacd3d9932b97ccfae11d10645891378af30528f449f3fcf846cc58e6435615ea4ecaad0366b3519323c507455970af4a8ac333
SSDEEP

768:xTjCQzTTYycM3V+QsBPSgbX1nL/OlVlvIwhr9aBRlXsPgHknyc3W1898K9q8eqMb:xvCA4A0QsJSg1/OlVlvIwhr9aBRlXsPs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1480	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1480	AcroRd32.exe
1480	AcroRd32.exe
1480	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e01ed747ebd6512ea65b30eb8d397d0c_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4544df0eb2fec3a453e62767a844a90e

SHA1
3b3f70635d1279d25d3a6d29447f53ac45d1550e

SHA256
4ad06a27650949a45c3afbcd7b1321f366b3d5068de456cb430226ff369d2b48

SHA512
caf1e704bebbd65827f6296ae439f1f812f78c1c2422aa0eeff3d4bf27037dbbff5ba72c6f6148a8328ca9d90cdb1ca513f5df4a98dc02ec968c905109ea1b9e

Download Submit