8be6101ea9155129da28bcbd224551dfa7b4271abf13da66fadc9fa50f429f6f

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eecfcc9a521f76dc4626402afaab68c3_JaffaCakes118.pdf
Size

123KB
MD5

eecfcc9a521f76dc4626402afaab68c3
SHA1

81e82832347fb8e68317029e02524c62ce44f226
SHA256

8be6101ea9155129da28bcbd224551dfa7b4271abf13da66fadc9fa50f429f6f
SHA512

79acc99b1586c17dcfd47ef1db5366e45e049a12b0bf820501c0f598c820802b13fd42282fdc2943b0c94ed59fa8331f3e911a7057034f435aaa8c7f15afedbd
SSDEEP

3072:jF9pLsmcUspjmJeez5u1yoF9Rct1GfhlKs8h8yUo/1+pzfDb:R/wmomJec4pKtsfQh8y31e

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
540	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
540	AcroRd32.exe
540	AcroRd32.exe
540	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eecfcc9a521f76dc4626402afaab68c3_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a4e3865328c4d79ce36e4c5dc7cf0fad

SHA1
0dbc3e4e147c070da4a10713384e83a3f2c1a226

SHA256
ffe1897e91b3286aa3c3bdbfe243c76f40a4868b395e673674374dab6ef4805c

SHA512
fd280525ffd6635962e6b585e27e128b27e1c4826ce46fad75a9a10bef00743a0ceb683c6b190d302d0f1e658a5a08428c162d45dd6cd0f3a081ff879cc70b4e

Download Submit