1477e1e77fc4455e777312c36ffa655723257cec91d1f414088332ca4d7c13dc

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 05:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab4c1541401930d2d6e9d1c8edcd114_JaffaCakes118.pdf
Size

34KB
MD5

eab4c1541401930d2d6e9d1c8edcd114
SHA1

c83924b4a017103dff4d7adad02c4304084c633d
SHA256

1477e1e77fc4455e777312c36ffa655723257cec91d1f414088332ca4d7c13dc
SHA512

7d6697dd6a6e689990217475f7d3d2bcea9049855dbd516868050aba1831cd89f0834c3562009f04b06c0c02248d6c086e9f12e83a7c85ae47bc7f7f8a578535
SSDEEP

768:BXuMZmwgCLWar+Vr1hIAnyCTTFsHi3wskBkpSFz3WeAOnn2FR:BXFZmGWSWhJntp3wsk6pLOn2L

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1928	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1928	AcroRd32.exe
1928	AcroRd32.exe
1928	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eab4c1541401930d2d6e9d1c8edcd114_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
84f79eae3f2ca2c68d12547e0273ea69

SHA1
e4b760ebd566513fd96853b4e1c4aa34cf28700a

SHA256
ccfbe472549d66eaff7cbbb48d7b166b13b3fe7fce805662161d585e1b4ba639

SHA512
64ff11cd58010b25f116a407446f4ad42a80e08ad3d4e761ca8be24b8670fb85d1d996687b4c05c901b048affdf7ca8c392288add72f1d6d92aa63e36a683041

Download Submit