8543eb4790fc8cc6161b38c1b20b483582f200ba9cb83f33a158059de06e414c

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee9fcba0d31e3911b0ce931e66dbf5af_JaffaCakes118.pdf
Size

42KB
MD5

ee9fcba0d31e3911b0ce931e66dbf5af
SHA1

65e5e898e833716ec3024900e730ab740621e646
SHA256

8543eb4790fc8cc6161b38c1b20b483582f200ba9cb83f33a158059de06e414c
SHA512

f07b6f20c177dc4ddc05be64e9ad54855b40c119abeb3cf560b64a5cc12575d86c07c9475af53822d342680882daf58facdb305aea6b343372b748dfaaac66cd
SSDEEP

768:1gGzpDtRsgXJz8JvOC55/3eFesPMiBxK7STkvW+4BwKsF2UMSflEOK59cP+YtXja:mGFhRXwlEec9xu2kvW+eA2Ste4+Yjvi

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1624	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1624	AcroRd32.exe
1624	AcroRd32.exe
1624	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ee9fcba0d31e3911b0ce931e66dbf5af_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
eb87dcd7f36a16f1d5ce7976228696c8

SHA1
50494fa2a87852e6e01f1b6b4e3af520338a8aba

SHA256
d16ddaaf7ca2456e916ae6444a6e7de59f3b6bbc7ba552a8025fc93bcb4655bc

SHA512
85f0d70353c925e3e94431966dfd04d5bfe7bfe0bcfe6e8e90c6b09f115d548e7d820f1658b74090ed43c419c2ee69766c1c0191db01c96424b2a0e2cf022c20

Download Submit