22c602100517800b0f79e12bc5a2651773fa1e707cd5bc29af1912393657aeb0

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/09/2024, 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9e2b76017b96bebd413912c9e9ee0dd_JaffaCakes118.pdf
Size

72KB
MD5

e9e2b76017b96bebd413912c9e9ee0dd
SHA1

f59e6f6eac8fb791d3fe9f6019248c1c7057f8ea
SHA256

22c602100517800b0f79e12bc5a2651773fa1e707cd5bc29af1912393657aeb0
SHA512

e5381912fe1d73b11dc49d19697b4fd0383df1a50deb01b0da558490e84078ae4e5a8a2fca0a5c231f32e7dca886dacd49582f543f8c0ffddd2b7ca2e9422f17
SSDEEP

1536:G8qqegvs+XnySif3bdiQPdhDBRGcw8qoKgOcuIHJNVNZ0+T3DBE3w/m:2LfaDifLYQVhPGcwc5vpVZpzBEAu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2148	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2148	AcroRd32.exe
2148	AcroRd32.exe
2148	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e9e2b76017b96bebd413912c9e9ee0dd_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7e79116906ff81d01877bf6c6a7fc6b8

SHA1
9f84afa8b731ee32ad40c0245244a408e8c2ffb3

SHA256
fbe2cf2ee296e11582e6afbbce9fd5e15b221dac5e2a5e1adb0f8cc69c7c071f

SHA512
61d217540074a990eb1142942ee770e1411e3265c330f6039c2459f2e1a2d69cf08ec630dd2965aec86171f190860d1b59f87cc47f98681e15bdd7789bc80b33

Download Submit