563438a04af4965b9c99b880721763dc9d11645e8f78d2e6a83e494ebce9a823

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaacb5b2fe703b0fe0d7ed19e6203eda_JaffaCakes118.pdf
Size

369KB
MD5

eaacb5b2fe703b0fe0d7ed19e6203eda
SHA1

70a74d94caf1b3b5f45d293d132b464fa94e70ae
SHA256

563438a04af4965b9c99b880721763dc9d11645e8f78d2e6a83e494ebce9a823
SHA512

9dbdfb7de783285454fb7b9cadd55e087c9432572d398dd0ab043347a3f63967e4d2df759d631d26446b02acf9e4d19969d1073e3b144226b715c99f812cc3da
SSDEEP

6144:qhbNZyy9wfa8g51HgVUsaOaLsoZEVZPkp07Kui4uS3W24v3uSo/ookN:WNP9wfkHN1GMC2N4CJjo/9kN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2308	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2308	AcroRd32.exe
2308	AcroRd32.exe
2308	AcroRd32.exe
2308	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eaacb5b2fe703b0fe0d7ed19e6203eda_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
09095d85ec86d0ef999fa54da17f8ab2

SHA1
cc0723aaf168ff11b9c5c6fa1ae04f6ca6ea8f48

SHA256
b6b3b6e53bd52357319b80425edabb1ab9d36bb78700b53582549632742e73f1

SHA512
90776994ce1b28e844589fe68e23c72f2e1384b7bd0f8c147ec22be6a622f42b181edec8f64cd159fdc0b0ddc25d67b3e860ef1f12b8744619b9550b029427bb

Download Submit