eff814d555912ab874d9125f44ab2ced0fac2e3f191770a946f9beafd7f97e53

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab20114bcb904242f904792bbc007b9_JaffaCakes118.pdf
Size

81KB
MD5

eab20114bcb904242f904792bbc007b9
SHA1

52fed49179424885b1e3000ca6ee799ec73f9169
SHA256

eff814d555912ab874d9125f44ab2ced0fac2e3f191770a946f9beafd7f97e53
SHA512

7a3f36e4aad5480c9ab3d2fc3206b0ae0007c08e69ec8d3bf5d054b15f78580b4bcff351e2f86046651b6931eb3a12510c35e802fe5f05d1c3f209dfa20cb709
SSDEEP

1536:M9i9Yn0VpZ02knpcCATgKADOtkrCjfjMLFsyAZWHpOvTWCrvd47S449n+ZHhMkkS:B96yZ0znSCATgKhkrqjIFJAHv1it49+V

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2064	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2064	AcroRd32.exe
2064	AcroRd32.exe
2064	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eab20114bcb904242f904792bbc007b9_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e0aa3d2423d0f1dec5cc6b64e5a862d8

SHA1
45a6e0e2fbedf29beb2dcf7d165984c3b5da241b

SHA256
2e672f5f27807ad72f4cadcbe88563e8ccd53ab5a462adb23a378a3b50ac1a6a

SHA512
4e8400d1b3f4e195b06cc308db36f241572c50db92ec93a430ee15e0e5b24604652e5f2ba27b50d2a73f44288bf011e4c08c1274faa77d0241da1cbbd16e160e

Download Submit