fe5e9e549dac316893fb7c57c002573b07eaf77357f011055b03e420eb6522a8

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ead29ffb7e48acc86e2e312465b87108_JaffaCakes118.pdf
Size

82KB
MD5

ead29ffb7e48acc86e2e312465b87108
SHA1

531256ed4a3ad3fdb9b951e5e06e5c2485a4fd64
SHA256

fe5e9e549dac316893fb7c57c002573b07eaf77357f011055b03e420eb6522a8
SHA512

309c60d11013c4df5fd3e8789124a3a552500969cccf89ae86637301c54bc7327f04815159274c34c5994d232932957ec95bcef5140113f1feae12a6f26fff21
SSDEEP

1536:dlrZ7yUzVxVq6U9v/Froo8mYDGG1Bn2vSKzbitpp5+mWrtAUjzI5uFuW8pO70KF:peUtqh9dodSG1BnYSKzbitppg9tAUjcg

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2532	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ead29ffb7e48acc86e2e312465b87108_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9fd2da7e0a9e7ea0e4e955876a42bf38

SHA1
07e641c4806f8cc314391dd6fb2dec9ea46d9465

SHA256
af3e67665d1713312e32f381d682ed9a82217c4fbceef9439d5f9451b0c530a0

SHA512
a566ba0ff4be7b67a085f0155aa7efaf74cb4eef1f96b607d6fb80a968af11a30f6005b76bd08e9d827e4a358fcfc37667a17c3584526e6f7800a173741e0e1a

Download Submit