b3ee7152bc677369bcefabe932beec558180dbd3155b3d15ec217ada49057adb

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efad440e5090e09cb2b4f274fc1fe65b_JaffaCakes118.pdf
Size

36KB
MD5

efad440e5090e09cb2b4f274fc1fe65b
SHA1

7f15e46939f534392f2d1c81461b74321709eb67
SHA256

b3ee7152bc677369bcefabe932beec558180dbd3155b3d15ec217ada49057adb
SHA512

d2dedac005172743a1e3b17ca04acb07395a9b0582f74dc12200ad54216d797312c69f92812847fb394002423e0ddfa599ebe856569973554718b80591ce62ce
SSDEEP

768:SQ/i3gFcG6YtLR48zmg8JdWnGavfc2S1SaVOVZiE1tRPpVhGvmyuDDQmalFT2b5I:TiGFtLR48zijWGac2S1SsOVZiE1tRPp4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2256	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2256	AcroRd32.exe
2256	AcroRd32.exe
2256	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\efad440e5090e09cb2b4f274fc1fe65b_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
eff155a7e20f8564b96f4033b1e2a7df

SHA1
44c1a3bd6a744c752ee6e75b0a0c94990f4987d0

SHA256
02381c872a6c11704e6c7556cf2cfa57cbbb2e332a4249e9fbec702aae8db862

SHA512
e79ef0d28c68ce4c4d46d1c3cf255405516e7dfb5a4e94a6e66b785ade38e616c6ecb3ce7689b4b7453678b37a6c1fac8606bd9a75ba6b0a789c5c50038499a2

Download Submit