1b90798739e53a7669c7537cb1fb852842600cc78e5d8ddbfa6d0b3f80a722ca

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea91964ddbb8f77c0c22ba93ac6cd047_JaffaCakes118.pdf
Size

82KB
MD5

ea91964ddbb8f77c0c22ba93ac6cd047
SHA1

df42ae22d99204fdc9dd243ba2a5ea8f40b9d2e3
SHA256

1b90798739e53a7669c7537cb1fb852842600cc78e5d8ddbfa6d0b3f80a722ca
SHA512

96a7142eeb820409f2d7e4db659aca505f0555c429af92ba333b77aaf31e4ca04198cc24ff6334c35d1685b12818f88deac38aee34775ddf54d99ad26cedbf07
SSDEEP

1536:60tSc2KjEAx+fcDhikgvn0FKEK1w5KhDyi/Evrcs8tsWULksQ8u+SWapOtQPVUJz:HtSc2K1i2hikgv0FKEYwsByi/8/eYvJt

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2432	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2432	AcroRd32.exe
2432	AcroRd32.exe
2432	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ea91964ddbb8f77c0c22ba93ac6cd047_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e4bebb20cd679644d93fefb437851d41

SHA1
c9ff88dc73358c82b1c4f4fdd520c19dc2da8ad6

SHA256
7f51b8a201871b4a929c0d772023a02f1ecef3f95725bf8abbff478ac871f02e

SHA512
2f0b868da500ea5103e0fa330016e0b5ebfe894b6718be313bae6b6d550ecc77c8e6fc2e110d207aecb4df057bec49cfc071d8195f37166e55339d4e6e4375b7

Download Submit