f8e77735cdab4e7642e82e3df90069d5de2c5fafcc4051173965603b53b03d45

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eacea1ef48b731a2805555a1520c5ae1_JaffaCakes118.pdf
Size

37KB
MD5

eacea1ef48b731a2805555a1520c5ae1
SHA1

8472e6924556e7c3deb9ee05a486041743538cb7
SHA256

f8e77735cdab4e7642e82e3df90069d5de2c5fafcc4051173965603b53b03d45
SHA512

793a61639a5a8eeea323cd0c5197900e41df297ed2b7a94678c666752512f7f084e490177ffedeef71178cd41593019a234136574a49812ff0344306711ab879
SSDEEP

768:YXuMZmwgCLWar6E5HpxFJ7ge6XjztNp6zk9HQbsxtYRRDrk:YXFZmGWSbjFJ7ge6Xj5NikYDrk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2656	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2656	AcroRd32.exe
2656	AcroRd32.exe
2656	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eacea1ef48b731a2805555a1520c5ae1_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6a3a7667614e076b34a9ca7f1719b306

SHA1
7cdc703d4d9693b692ec35cc6220b157fa845587

SHA256
8ed5e116b813259c8fd3b5166bc1cc5ad46e685024c1e7a26ffaa5f6eab0c631

SHA512
cb87e5833de1cde2b1b1e80d8aacee4f647e769dd5ad05a128a65d254d511135d524b1e77eef0fe589567d3387a19f5ffcbb8ee7c963292467279085f84f1142

Download Submit