94a4a22649204b6625bafc77f9f6609d72a48bbdbd663f9c7952c695827df312

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e070b8dd2681e96768d834ff366e3767_JaffaCakes118.pdf
Size

184KB
MD5

e070b8dd2681e96768d834ff366e3767
SHA1

3098648efa5baef4b31e93ff4c4ad31b739ef12f
SHA256

94a4a22649204b6625bafc77f9f6609d72a48bbdbd663f9c7952c695827df312
SHA512

950e7c087392cb4005c075c7269f8497b20fe66895c9e61c9013ce1792ba27af8d22c0dd185aa4574ea90a63f9e518443250f7ffa14c27a3fbd9361c0bee03c2
SSDEEP

3072:b2irbxzGAFYDMxud7fKg3dXVmbOn5uo6Kjnf3ivAfL8L6wpKKq9okDBSB:b2MKlWQ7Sg3d4bOJfGWw6wpT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2308	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2308	AcroRd32.exe
2308	AcroRd32.exe
2308	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e070b8dd2681e96768d834ff366e3767_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cce586eaa6bd18fb5c799ef2cbceab6d

SHA1
847108396ee2b7520dd87f855bd59844d72d7d4e

SHA256
8843a5b0aa1365e96d05bebcc34bfa8ebc45adee8002d5b958c832c14f2bdfab

SHA512
c12cba7058c62d4117d554acc9a560f04de31c0b8d1e555ba183c23a8e0b1e24319d237ed9b9e86cc9173b683b4acefc8bf5eb5571683c6c0c03cbd90822dcc7

Download Submit