9c90831be3e6d7fb9e9dae56137866d8bfbb5c0a61f4f71095b72aefecd5a661

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1865eb3050f335586df16ca042585b5_JaffaCakes118.pdf
Size

48KB
MD5

e1865eb3050f335586df16ca042585b5
SHA1

fdad0af6568eeb042c757e31e8dced81b65d1d51
SHA256

9c90831be3e6d7fb9e9dae56137866d8bfbb5c0a61f4f71095b72aefecd5a661
SHA512

a84cfd55ab078a01740decb1f88c9c4b8b56b205b4bb5ff20d21b6d8c64729fa3c1b15e946165757df3ec94b688d7dbcf41aa2e34e7ffb2567616bdd0b831c24
SSDEEP

768:QgGzpDyBVksi8JRTVmscvw+INBbLPmEOjWs1l2H8SVB8Axy4AXADXRtzb:9GFmAEOq62dEAxNRtzb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1244	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1244	AcroRd32.exe
1244	AcroRd32.exe
1244	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e1865eb3050f335586df16ca042585b5_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6e7c50313c3c665a7bf4ab9af8892f12

SHA1
381078e845bdddc4bb82c54fcb546cb0d6fc3cfe

SHA256
9ed01cb6ac38d1fed9c18970c71d2a22fe740558c6b6b5123d3e688cf1f382fa

SHA512
27bda66a1f5657074521516539d8515d8c15ca674bdaa5ec047d47b6a3afe59ff9b2b11bcbe5d3ddff4bc74289beb71facc173bb1fe95dfc74b17215acb2d580

Download Submit