f1cdb0a4a3a52c12aa4f494ef1d9e4e6fa7b97e95b1f47e4379c1cdd24aae275

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 07:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ead0ed2b4e630e790c392659b238ba34_JaffaCakes118.pdf
Size

86KB
MD5

ead0ed2b4e630e790c392659b238ba34
SHA1

428754023e5c28b8cc8b2b67aa1b11ca37bcf28c
SHA256

f1cdb0a4a3a52c12aa4f494ef1d9e4e6fa7b97e95b1f47e4379c1cdd24aae275
SHA512

f71471cf28a412e698546da23758e4c36b45800f93f1c2fc287ead4c5842fdd1dbc9f385044b9ec102087d327ba4ed081f13491a1f423f68dca6ddb09f44bc2e
SSDEEP

1536:O0o9E9aZr4NTn2fA+ZcyAM6yJEnRPuUl1RZW8ap542wWQpOCBqT:Q9E894tn2fAWpP68Opl1Ruq2fCk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2092	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ead0ed2b4e630e790c392659b238ba34_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9e2a58a00690f366bd1ecbc2b30e8759

SHA1
11894c18bd4c98ca3f885b7d68c3c72213d50095

SHA256
89ee44a51731045676d4a064a7812f5d855119c22430193c756e47a67f2ac463

SHA512
8203661f036db6bbe7ff0a076f0561b2d57b6291ccb19cb4142a0309bb0e996407ca03d85f871dd239c6329b76387cb985a3730a34e332b7e47ab2c91244d051

Download Submit