06c821619fe07b4cad24128f793de3feca6a1719b64f8272e152d4422d31f4f5

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea2d004a978efe765b887056003dd659_JaffaCakes118.pdf
Size

78KB
MD5

ea2d004a978efe765b887056003dd659
SHA1

972277ab8b2f23efcc379b06f254239dfadad3f8
SHA256

06c821619fe07b4cad24128f793de3feca6a1719b64f8272e152d4422d31f4f5
SHA512

a47b4c8778c24cd13784c9f93b2cee13ff46e96f364c6b6f043fb2bf655ff1441ce83959d1490840f9c352efd14fe428928704bfa725f159ce70d1f363311e6e
SSDEEP

1536:rHHtUEbTRThq1V2D7le+iFzbrXLQ64c146za2F2QXLWyXZCpQ/XpG:DRmV2/QrLQo46udQX7pFXpG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2320	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2320	AcroRd32.exe
2320	AcroRd32.exe
2320	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ea2d004a978efe765b887056003dd659_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
46544765942c21d530d95d467a25036e

SHA1
062db029cb0bf69ab300208a09af701ce9715ed1

SHA256
a1e98f6123486a65b1004e19da9442868134c8b8646f0a0c5710a1aebabcaf49

SHA512
66ffebd74133f39eb225e8c05ca0da265b6be4bcbad8cb56dfd286a4a77a5502b482e6ac378a7b5de1a67bf4653fa23a3a7e8c434fcafc609c4e9dea4c490f7e

Download Submit