4a91e0b80a6ed436c7c4c3fd2f3ac853f977bc63dd563cf81075aa75bc336e67

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb483c3fc1f53633ec116d917f2bea5f_JaffaCakes118.pdf
Size

66KB
MD5

eb483c3fc1f53633ec116d917f2bea5f
SHA1

cd22a74b729f72cbcc5b9ea984558221225848ad
SHA256

4a91e0b80a6ed436c7c4c3fd2f3ac853f977bc63dd563cf81075aa75bc336e67
SHA512

0472f1b2a269685802227bd940226859938ca19522d4f5a9af0fb80d83298c3b0757248d69dbd63fb56bf31c8dc1dbfda7bd1fa1bfb92d10169bd3636f10a065
SSDEEP

1536:GXFZmGWSTSz+ytl/9brRAIXPHho89WWt34GSzwGJxt:cysmz+y/1xAoBo89OFl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1952	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1952	AcroRd32.exe
1952	AcroRd32.exe
1952	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eb483c3fc1f53633ec116d917f2bea5f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
611e74b0e7a5b3abd8170fee11ade982

SHA1
94ba31d2adbf8139ce543b71e6893fa8292a30d2

SHA256
694bda56e51944d19881b7f64cd6138ecaaffd87f20710b8702509b3fc56031b

SHA512
3ba2813f6ca60ce34c18b47c3cb956fcd8625a83f4fc1abf780fa65fff91f9060fe8d6b721dcc20a85a142358034d59514e036e4934d8f5e5db9384134953f18

Download Submit