e5969c4dbc392e4db022af8882f1238c2b0c668dcc7fa4b3abe826d692862ce5

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-09-2024 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1e4b7d57bac7b905f09b3c214a5ff8f_JaffaCakes118.pdf
Size

88KB
MD5

e1e4b7d57bac7b905f09b3c214a5ff8f
SHA1

a6e52f9969eb772401c016317fc385c9e2829777
SHA256

e5969c4dbc392e4db022af8882f1238c2b0c668dcc7fa4b3abe826d692862ce5
SHA512

e711cd1bbd33557f9d107f0c3f50af3c21d13376697cbe0d7b7c10358f53173810ccea57f88c4a0c72a6d127ed8f60dd54b2b940e4fd44552c813a362e4a4eef
SSDEEP

1536:DfBGjIEekqFqwt7WHYQwSI/MHjnE5S/umBPiPA8wjaxWHpOvTWmDf8zBVkl0PIzG:rBGjzekgc9fI+7YS/uKYcjavv1Eel0P9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2344	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2344	AcroRd32.exe
2344	AcroRd32.exe
2344	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e1e4b7d57bac7b905f09b3c214a5ff8f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
abe53e7a52568362d77a715599698c3e

SHA1
f05757defbe2bc03b0b11ba842b3bcfbbfc329ca

SHA256
d3b6046bf4d73e71734ac8207c27dbee1796b13e2d5ea73c140ccba99500a424

SHA512
06d26893421b71cdc67528fcb0bd0e8948fbaf8b545554981f9454e933878c1bb6746cd4a3988a4a25897794edee0332009ffd2bbf39ee1dde24e2a66ea94b75

Download Submit