e810fca4c83a1eab2bda5e58be15a422188baa0f709d972c9d4cbb0e9658fa47

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea867f06ce0bc8e1313249c9bd515cf6_JaffaCakes118.pdf
Size

70KB
MD5

ea867f06ce0bc8e1313249c9bd515cf6
SHA1

258a937d3df2d8d2c480bf9cec0e9b861422883c
SHA256

e810fca4c83a1eab2bda5e58be15a422188baa0f709d972c9d4cbb0e9658fa47
SHA512

9032bfd127b4a9bd08a4b89adaf8dd726f50d1813a27384f5e88185dd255873661407f3c3564b56b76e8bbd98e50b8f12ddec8b390a16829935252bffd010682
SSDEEP

1536:NX2zv5hNc9hXrAh19ha74NhGxATY/noSbx:NX2r3ObXrM1bNjGkknpx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2544	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2544	AcroRd32.exe
2544	AcroRd32.exe
2544	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ea867f06ce0bc8e1313249c9bd515cf6_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e77ea8fa8dfc9f2f48c4f3117d67e964

SHA1
2a2791d5c622b5f82792945ba2de64edb2fd6ee4

SHA256
65b9407e03be3135b5c79d9e7c6fe2bfbdf93a76ea0d1ffe29b253267655273b

SHA512
3109e618dae5ad095909b938f89e934a9be7872826f5f316dcde1f3d1a193f1bb4c1945044e943bd37f7ab0c10ba56b27fd22d1418ba173022ba4bac64b15d1f

Download Submit