672b80517dc0607bb4e3edac6e345267756ce3eaf13edb50d3b8736642e04683

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabe87391d59291f5be04acf9e84e617_JaffaCakes118.pdf
Size

79KB
MD5

eabe87391d59291f5be04acf9e84e617
SHA1

6c493e7230c13dfea8d9068ee509456d59adb3cb
SHA256

672b80517dc0607bb4e3edac6e345267756ce3eaf13edb50d3b8736642e04683
SHA512

80d848ab70f07775db5601ea6efcb51cb2323e09e023d9700db330fb6ad71b0eb7869bcd7059def0c61879daa229a7acad4ddbc311ac45e7aa982218ed122dee
SSDEEP

1536:1UOmUoCGysF19xEnGpXclpOqRdGTU9CkaqDG0hQEyWkNpOPaWkMgQ2bYJ8eC4b:2XZCxsJxEnpjOq6TU4kt12oPGQFJ8Ib

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2132	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eabe87391d59291f5be04acf9e84e617_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d92ead785782f381d5a3e1908fcb1424

SHA1
c36bd3194aa2b92b41609cecd9c5f072f8e6dcfe

SHA256
e1b17cc317733bfe9cfa3a5dd8f54f0a0383b1d3a09b0f6f6c270afe1243873b

SHA512
3adb7a85981a8609fd521d36a139387d497a7df849bb924c7a0d681618ae472c4230b47cf070fa57c3ad15e1b56598367f204746c8a8da615aa2ca81c94f6878

Download Submit