7b7aad0f1f9c82f539e7fff0a348bf14d9f22ee2706622285c357066b24d847a

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabeee327a5c449c772a5607146aa021_JaffaCakes118.pdf
Size

42KB
MD5

eabeee327a5c449c772a5607146aa021
SHA1

f44afdc265872692d6af8c45bc45ae028bb96395
SHA256

7b7aad0f1f9c82f539e7fff0a348bf14d9f22ee2706622285c357066b24d847a
SHA512

6a4fe57b4610fb75e067d6c0fc80a9a284d0281c5d34088ec9cd4d6e2f935b4bf7b3f0fd4626fd70966a34e8ee4546c49baf69e339298ab09fe33c4291a75c95
SSDEEP

768:eXuMZmwgCLWarcVzuwm6+nD+3BnEkz0EJuBydBPSt/kaeml8:eXFZmGWScBbaA7z7nB/aeml8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3000	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3000	AcroRd32.exe
3000	AcroRd32.exe
3000	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eabeee327a5c449c772a5607146aa021_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e266e2d6c88ab28bb82ae76226b09ab1

SHA1
763151d4730958decd48ca9a5a80e811d2078080

SHA256
e0b4e2ee35959690d40df3ad00e02ab3287559d359d863300310a87db0176b43

SHA512
b6bb97e9ee260d127e63d566c4fc1f420366e5a06bb8a8c4da23093b5ae8363e99f687477963ad4203815b5bf801799adf1b9417b0faa01c0aab6b98fb7b4d78

Download Submit