ba566b7b05761757bedd78aa285dea8f2f352aa0c1fad0d23a56d30d965f9e25

Analysis

max time kernel
111s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0b41552bebe76194b45fda39d6807b8_JaffaCakes118.pdf
Size

33KB
MD5

e0b41552bebe76194b45fda39d6807b8
SHA1

7973bff88024edcf8d68614c63849a794760fc22
SHA256

ba566b7b05761757bedd78aa285dea8f2f352aa0c1fad0d23a56d30d965f9e25
SHA512

02f1f9aa83b51285ecd9399295c457049bc84d312517546f8d905e724d1bbdcc3ac9c10be9335876f1431664672ecdc6aa4d96fa7ca9719356de4fced1a82483
SSDEEP

768:DXuMZmwgCLWarwIjVG76NaAQqkKK0SpzYRl:DXFZmGWSwQNaA8KK0SpzYRl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2564	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e0b41552bebe76194b45fda39d6807b8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0187f0b4bebe8b93cc40cfbdeb30aee0

SHA1
5a8243077cb1fddf82ebe6b63b48f48b7e0260f5

SHA256
a1e530a39e099dd898b8ad938430925cbd2925a82a428619fde8941f5fd9623a

SHA512
bdf4ba38ee3422737adb3f68182f31b63162c629d2084fb5e11c852363f572206e7fe89b05d316bfe8f5c0daf8a43741cdf19d4972d92edefea18f705ca8a6bd

Download Submit