111d41e93325045097eed6ebf44046a122221841d0220efd7b294a18dc21ef53

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/09/2024, 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9daa893fd429b75794c6a5a06fb7a47_JaffaCakes118.pdf
Size

49KB
MD5

e9daa893fd429b75794c6a5a06fb7a47
SHA1

10d69195dafc08de41a1f014b852844e14774747
SHA256

111d41e93325045097eed6ebf44046a122221841d0220efd7b294a18dc21ef53
SHA512

95482463cfdd339aa6b2deb742db511c17ca9e86330ff13ac20385c41d58906c8602d207d417c4a9530e127a39f5426c8cbfe503079f9b31d112ad1659fcbcb6
SSDEEP

1536:6GFf8ea7u0F0r0NFGj35ii//6bqhHWHiXhFpZ4:jFffaD0EY/6ehvc

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2272	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e9daa893fd429b75794c6a5a06fb7a47_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f766f0974a3bb0f9e79cbadeac51f0ff

SHA1
66907e02644d3e4a08bcc9182956a476cef7f9b4

SHA256
b0e1746f14617460138f45b5a10f2e700b121275fbe2dd692325e951990c8410

SHA512
70640632974a7f5878719d62b761eda8ed6616510edf68da6ac2bde08ba61ce3690da8190ecf927da3b26531f3358270ff09f13edf66f2400500d872078aa0b6

Download Submit