90207d5a409bca53428d7559237959046588de4baeebf8d131512896a80a2efa

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1d80e16a2325a2ce2bf7b93ce62348a_JaffaCakes118.pdf
Size

70KB
MD5

e1d80e16a2325a2ce2bf7b93ce62348a
SHA1

41a8bc98dd7525fce0c66677bbedd10e62ec1bd0
SHA256

90207d5a409bca53428d7559237959046588de4baeebf8d131512896a80a2efa
SHA512

872cdd11104a555d696d70edf3d013652deda29f4132b5e928e1b609f0e1e794df624d6d278f6e66e285e84fec7c4d5287e2c30c0967dd1ab1288afa9d1f2382
SSDEEP

1536:Tt7BRCnCpZHZhizc22gbLW1rQ2uARb9CLJwNrW4/lvf2wqcgEWQpO+:57nCnCHgzc2zLyQ2uAR96Jwt/l2w7gD+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2536	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2536	AcroRd32.exe
2536	AcroRd32.exe
2536	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e1d80e16a2325a2ce2bf7b93ce62348a_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a4e9d4617c9b00ea464b1d6aa8819c3b

SHA1
b5df7191f08b6ee6b08c8855c5fd4cf2a8013d55

SHA256
7deaa5dc5f3983d8318b5eccaed6889219c3950e1887ae6da882956ad7713886

SHA512
a5a3b1cbe9fa1b27daa03b8fbf6f9b67ead0daa626657056cc763afc860aabd063f7bb2b03bbbd727fec40beeee6809c88e024f590d70e0226dee59561d86c33

Download Submit