74a589d35f330def271faa6fdb80b67384b64c72a936e84205c6e0f3a83c879b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaa1627d6ce4f4b8026c76161a6e4984_JaffaCakes118.pdf
Size

33KB
MD5

eaa1627d6ce4f4b8026c76161a6e4984
SHA1

eafe84095841e3bbc0ad26bf763038c60ce22a96
SHA256

74a589d35f330def271faa6fdb80b67384b64c72a936e84205c6e0f3a83c879b
SHA512

0d1ff9e4a8f1eeac6aa34bd2eb8ed48f7981ede04ff3f4064a8674f59d7fe1876c13cfcc93155322db189746d4eef5092918fc1089022f4136e0a0a56f4ce359
SSDEEP

768:A/CUPhIk8XCW3Issc/fCP8CyU8K9h9DQrux+xRhJ2v:8h233v/fCSJK9D5Ixd2v

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2120	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2120	AcroRd32.exe
2120	AcroRd32.exe
2120	AcroRd32.exe
2120	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eaa1627d6ce4f4b8026c76161a6e4984_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c2dd70d017905a31cfe9c50f009eaa79

SHA1
71e6e0afdbef4809a1ac6d666ab911b33a9a5497

SHA256
a8f9bc1a2678031474f26ddc561ba8df607e991a378dbb11911dfd95571191ba

SHA512
540b34e9e253a2b8c00fdbad40927cf880854c945630cf737be03841244ac349cf342f3a145a2d71106d0af948fb0d5a1ed3e4c818f5c00ab54154376d6577ce

Download Submit