e499322d789731a396947bb8acda68e66ed9728214161d9f1925cae7b710edb4

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaba8a55e5ac3a4638c85d2655073ab2_JaffaCakes118.pdf
Size

78KB
MD5

eaba8a55e5ac3a4638c85d2655073ab2
SHA1

eda96ec2e1c12fab9de9e59ae3101cd49a45239d
SHA256

e499322d789731a396947bb8acda68e66ed9728214161d9f1925cae7b710edb4
SHA512

6dd4eb44e5ea525eeb08681ada7d3ed754d3bd76b073964d76516f7ad158986c483a77cde5ef16d074a622787c5b47a592492eb203c250b8b1012a499c5096c0
SSDEEP

1536:Q/uT7D47c1I5vLZ6ftEF4So15jYXWkNpOPaWnyYsLzNZvS/8cLlmD:Ac4xLZyE6So3s4PDs+/VLs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2640	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2640	AcroRd32.exe
2640	AcroRd32.exe
2640	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eaba8a55e5ac3a4638c85d2655073ab2_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9bd33520a5a3e69d568286e6cd1740e1

SHA1
40bf7e53af7b683386a6b426a342d97c3ecc60d8

SHA256
25db786ef93d08af5e3ea7735152930b46d98a3f9bc62da851433b33891185e7

SHA512
96c1460d36b7bc460889917e0d75aef86290a332f4a40992c809269fd665ba18829de106c76d786c4ef9bcaea92297412c3726442b74f037cd6ef5e929afdcb7

Download Submit