c2f9253174fcf62c9697ad7c0ce9b09cac82a6462eece8e5b7abb7c290371723

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eacc306d6142b3bf7ce7fabfc2888729_JaffaCakes118.pdf
Size

45KB
MD5

eacc306d6142b3bf7ce7fabfc2888729
SHA1

f01c6e4db1c7ab702c4312de19609e3132a0d2a7
SHA256

c2f9253174fcf62c9697ad7c0ce9b09cac82a6462eece8e5b7abb7c290371723
SHA512

c709437144b0518cf236fb2a75a292bce855e96ed8cf5d8fc98e512867e935662647f4750d42d06568ad30122fdd2dd58252f979f9da7ea4cadd3ab6b70942d0
SSDEEP

768:EXuMZmwgCLWarbE5HpxxFHusdAECpObps4g1wZtrtwKX3P8zAZ3HtViLt062VLei:EXFZmGWSUjxFHusddCpObps4g1KJtwKx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1892	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1892	AcroRd32.exe
1892	AcroRd32.exe
1892	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eacc306d6142b3bf7ce7fabfc2888729_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4d749d6112563120e5a06e8c580075a3

SHA1
7657ee9420938eb6816164c331ce6f3ecfb3b3e3

SHA256
e9f4baa17cee0ded685aabe3c14648339ff755ca9e94e1d46b3cd9f7c61e0cb7

SHA512
2b360f2109fd9804fed78601f2d71b6c8cd25b42aa9da0de1ad2166ad3964b2e38f6451036788c1478571d076cd6801e9fa514392eebd4a5b9019714f19a4cbe

Download Submit