781d55381627f0c747a28f0190966e891b1d81ee19dc1f10df9425e35f3d251b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 11:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eb47c1442eb4cb1d61ee6eb330619882_JaffaCakes118.pdf
Size

60KB
MD5

eb47c1442eb4cb1d61ee6eb330619882
SHA1

ac380c0268a7641bcdbfc14385fd401b998733be
SHA256

781d55381627f0c747a28f0190966e891b1d81ee19dc1f10df9425e35f3d251b
SHA512

e3678d6eb7edb503d126572aa631fba5274ed1b5429ea73b04b630082491ab7e8d1672694d9535535750c271aa06465467a835a0aa59736ae426dd0669fb1689
SSDEEP

1536:0b6mqmqRGkQzdp/32ZU+fdBWhdj8swMt4:+umqMJYbBWhh8swd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2684	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2684	AcroRd32.exe
2684	AcroRd32.exe
2684	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eb47c1442eb4cb1d61ee6eb330619882_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d470dd7c7d8ce9d9c4800293b2eab8c6

SHA1
2aba6660d856d0b48b43c9f359a8c1a6a4dd5e97

SHA256
d917a4d7423b0b658471e1c7dfa6bd947459be531fa2d0f5b4975b7a6df5f9c1

SHA512
365bc98ef2ec5484ad5f032c68fd7e67818034837fe31fffb7f510df7ec0bf20382afbd9b1fa2f40ab9c9334b6154b43e7e74ff5c827b8f7e0fa400578cf580c

Download Submit