1022d112a1f116eb5df4883c8c9b638be917a3cc5f8a14c0836ae431385410a7

Analysis

max time kernel
94s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 04:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea8cb3c7473f3ed3e7eec2caa1499fb1_JaffaCakes118.pdf
Size

34KB
MD5

ea8cb3c7473f3ed3e7eec2caa1499fb1
SHA1

454c946d0a8f1042837bb12d5c5afe4ef9ad5918
SHA256

1022d112a1f116eb5df4883c8c9b638be917a3cc5f8a14c0836ae431385410a7
SHA512

c792e59deb63a1a41aca66c2171f2923c4edc5fdc9b0aa72d8f63d7c6ff72bbaf8f5a9a583c39350e72e9aca528270aefc3c54bec55cdd99a3ecdb4381b2dc32
SSDEEP

768:9XuMZmwgCLWarl3Vq1WSmV81wmtNHfFUSCeD43RgtFifOXm:9XFZmGWSsCV81wouteDgRGFifWm

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2684	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2684	AcroRd32.exe
2684	AcroRd32.exe
2684	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ea8cb3c7473f3ed3e7eec2caa1499fb1_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c65784a63175de4f37ee14a1422b925d

SHA1
2fbf8981562f1d1f05d2d355567250613c5cad65

SHA256
822d74e612c56219d6e00409b03572d1b7343b34551697fa3e54a275e6e9d079

SHA512
863ecf3901075dcdb73db9cf82c27958b7e3b6d7ea55f99f81c8c4141fc28824ec28972ffd54a7b475860ac4d7b8347116cf39a387464294a42eeea5592177cb

Download Submit