72b5a7779b027508de821383db4ee5c813167741ac1d2d58b510d84e15a5a2e3

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebdc59675872ccc20ee5797866f7ec28_JaffaCakes118.pdf
Size

84KB
MD5

ebdc59675872ccc20ee5797866f7ec28
SHA1

36b45b1f652e0ecd9a04a06b8fef6e15df8fff6d
SHA256

72b5a7779b027508de821383db4ee5c813167741ac1d2d58b510d84e15a5a2e3
SHA512

06a1a6c11a9f92be6243caf3b5ffe74486b43c64820de2975fcb00d22b67c13c21be5fbe031f3668b4ea0ff786ba39262f014de2998f62dd7a46a5ac51497547
SSDEEP

1536:d2IHHrKRMJIcnGGeUbb2u7l7xQo4XyIJj5hEhb7QAoc8HWQpOCoW/R/pUwXOUSqw:4wrZjbeC2slNEXd1EhvQAj8yCBpUwXmp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1744	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1744	AcroRd32.exe
1744	AcroRd32.exe
1744	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ebdc59675872ccc20ee5797866f7ec28_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7a19215b862710d99a68866369f3f0df

SHA1
c9372de4e7173357d94e5501cbd08811a86c4c7d

SHA256
84f3af697b5e2a5bc017c09c024e276f63bcf10646b14fa27868b827edb2fac4

SHA512
9062e41676fc44e37eab0d770a2f2a15f60ef9d45c3e3a0cbe953eb172f56137a89102104f26e8cf50e296ed4d4c0e0c13eb1fbadb51ac54a9c61bb65a4f6ddf

Download Submit