46fdde224a8ac0eb56a29f213f2af6c2719f5a7b809c84e93d46e87703796f80

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea7914f7392aada7b3768b354de443fa_JaffaCakes118.pdf
Size

41KB
MD5

ea7914f7392aada7b3768b354de443fa
SHA1

0616a042dd98e1cfdfd2b7796dc8f7072ac9e644
SHA256

46fdde224a8ac0eb56a29f213f2af6c2719f5a7b809c84e93d46e87703796f80
SHA512

fec0b91f38e694d751052fe2aa30159bb281cedb49ccb95158bcaae27a690bbc37789e7facaa0883ee8406682652ac32a668ad80ad13b10330c8c9f340dc4841
SSDEEP

768:Haen04Q57Pov9fgXIAn6+bLH60Pqn7BJpgxv2lE59XuMZmwgCLWarpL:6204oPov9fgX5n6+5wlvM2SXFZmGWSpL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2412	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2412	AcroRd32.exe
2412	AcroRd32.exe
2412	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ea7914f7392aada7b3768b354de443fa_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
994328ce48d7b939ddcc6c8fdf92bf1c

SHA1
9b901feb9cb7560f03fb2d379ad61f60751d7982

SHA256
96cb5f44dedc3f521fa8f21eb1378d3f63f94671564553e6b38e95fe2da0be4a

SHA512
dcc5bbc331e149881a918ce114144feb85f2d0c4b853ea4895c78d8658d7e3234a816cc8a3ee402cdb21898e2dd69babec3b56624e05491ab0aec985e397c6e7

Download Submit