df22d25a564fc402f6b80b472cbc34e5927806c9ec0dfd9ee92af007945f7008

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1c41de5411dd4aecacd00fcd12fad09_JaffaCakes118.pdf
Size

91KB
MD5

e1c41de5411dd4aecacd00fcd12fad09
SHA1

4c2f60fe919c4ae26eaeb05dd80c55005b7b4f73
SHA256

df22d25a564fc402f6b80b472cbc34e5927806c9ec0dfd9ee92af007945f7008
SHA512

0e7d9f1d26421b2ec9bf6436741dc6da885bbf827462688896cc157da8a864b4f0e327cc0659d8e1bb3d4ed4f63a388d1f52729da9d0af6012089bf7dc6445d4
SSDEEP

1536:4ieA5HvUrGEp9w89ZKjBvY/wxRl0lw1QQsK2NEnLYOt7AFW9tRyJlLEKWOpOZXIi:beGHvBk9T+NYURlf6ensOt7A+EqvZ5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1868	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1868	AcroRd32.exe
1868	AcroRd32.exe
1868	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e1c41de5411dd4aecacd00fcd12fad09_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d526954013160b0ab35e86bce7a72d23

SHA1
461e6fd4536e42c1c61ec105e7d3e39af055cfb3

SHA256
0f1802303610ec2ee9013a67aa9e9c2fc14a0c4a5aa421ed0eb9464156f04cb0

SHA512
c9efe8aca10313b18ee2ca71f6b8dee9abfd2436d6fb01247c1e5f7bca3aae131ce0b0e8da6851426898d566753059b594498ab22ef7ea4981633bbde7289110

Download Submit