5399772ac4d76c984b7c02defd4e1ac92e0e0bd4a05ebe47a39879c47e93a897

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9d6bce7e7af3588ae5151120044a2ec_JaffaCakes118.pdf
Size

42KB
MD5

e9d6bce7e7af3588ae5151120044a2ec
SHA1

9f0d5380a3b039628dcf3f649ae959ed0035588d
SHA256

5399772ac4d76c984b7c02defd4e1ac92e0e0bd4a05ebe47a39879c47e93a897
SHA512

dd6aef8ee7cf939176e0c2eadd665955f3e988f5f1cb5efd6637a74f561c0444ef3c19bb841da614355a5c4ecadb8175cd23454927d4a5adb893a5569863ebad
SSDEEP

768:5gGzpDKjQvkwrWv9BrWbOrG7NJYA1v8CQH6TjNRLGlKT7SkeN:6GFGzrWbaG7NdvDVRUKnSkeN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2324	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2324	AcroRd32.exe
2324	AcroRd32.exe
2324	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e9d6bce7e7af3588ae5151120044a2ec_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8ab56314537a8ba6f9be7b567783abd2

SHA1
5cb47f1a4432508e9801ffb5d169f6e60a3fba7c

SHA256
77be584e10bda64ed0640c4c78a05834212da5bdc54f35191f6283f7f64e26ee

SHA512
7b52d6c95ea7cd1090febbe281bb8c35282ea91422b058c55c431dd76e30d96fccefbfd26314e9ea63ab9121c9e082fd1bef41d533f8cd4cd501290ed7ee6b91

Download Submit