5b42e89f8fe511c57dfbc36fb357400b04ee5e5e4dd608b42221e72ced498db2

Analysis

max time kernel
96s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea8c064800f7548fc899822a7f6f64d7_JaffaCakes118.pdf
Size

91KB
MD5

ea8c064800f7548fc899822a7f6f64d7
SHA1

3a0877d43ab99cc26432aabbf7ca8b6da2a27005
SHA256

5b42e89f8fe511c57dfbc36fb357400b04ee5e5e4dd608b42221e72ced498db2
SHA512

453a4eba5109bfa48e69771cfb1a4a04181f620c481ae651475362c5b947620be5fa2a3087ebc436abed7fc6f01269eeb29fb99d819d097336c54588412c2531
SSDEEP

1536:od650YtqCqHF8BHIW1UDQOBJWvNjyQgCw94oqpTfgcFZWbpONiWjsI4vH0b97:D5/2FaqHBJWvNf647zHFbN92fK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2716	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2716	AcroRd32.exe
2716	AcroRd32.exe
2716	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ea8c064800f7548fc899822a7f6f64d7_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
06986d81f8e2fdf9d39c3a3c2298090a

SHA1
82f6be013df14ca1808adf1a88bc53331f5bd72e

SHA256
10324c781bed6e18e657591d4883f046873dd79c9dcaa41352da6fa7a4d8e786

SHA512
8cab3de1c3b7454d24b986953729589f9efab5b02b7f87e19b2f60c2f274c90ab0516411ad61f7e793d8bea186fa96644be33cfa78b644e795cdc43dce520a00

Download Submit