0979d0c4f4a2070506ae303d6a0b4918fbfa7ca1a69a97696f80c60a85306cc9

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/09/2024, 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea1c1f33fb1f69446fa48032d0221b9c_JaffaCakes118.pdf
Size

90KB
MD5

ea1c1f33fb1f69446fa48032d0221b9c
SHA1

2aaafbcfdbb5eb3b068031f56922c5a96aa7bbc5
SHA256

0979d0c4f4a2070506ae303d6a0b4918fbfa7ca1a69a97696f80c60a85306cc9
SHA512

9e2a5207f4b00d318b55a08a180904c5596df4ac5314b1a54abf8f987f1978ead0d58886c474056e7291cb9bb3f54d2a16ecf7f0bd1d76a900bd786facdc3b29
SSDEEP

1536:zd4VzqnFXRjRxADoSSo+0GHCsU4Rf9tkdWWCRbVM8RbCIRWjpOROMwj5+WK5Yv:hMuFBdm+9UifrEyVM8Rv3R0b

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1660	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1660	AcroRd32.exe
1660	AcroRd32.exe
1660	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ea1c1f33fb1f69446fa48032d0221b9c_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
eabb52cce6075e62daca772228633783

SHA1
d24b4615e53bf0a3247bb6b7d27d7232a0bc5714

SHA256
c81d3abb252af8fd2a3757a7a641429a3ab0843b562b716eea0b2d0398751a00

SHA512
385e241d4fb04204b8d26050144f62d613f253b763b8c9d6957e8bc21af9a15dcf611f305c85fa64133ed22262ba17c0b6aca7e2fa85abbd82dde82839a2ad22

Download Submit