e23174def5c6ef96a26065e9f6d5f701e6835a6d68a0f06653900619be977116

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ff7994e1aa259278ae6e9274ff890266_JaffaCakes118.pdf
Size

17KB
MD5

ff7994e1aa259278ae6e9274ff890266
SHA1

bd8e415024934a97b754165b0e648858aadad78d
SHA256

e23174def5c6ef96a26065e9f6d5f701e6835a6d68a0f06653900619be977116
SHA512

d813c075f97c21c4ba3bdbc7f6db751b5aee76f376cca792fdfe2e594b3ac0a04633ae5396250173776c9ab788404a3c6dd909ec3ce25fff1a7c22d91cfbe85b
SSDEEP

384:VzMGHz1U3Y60mT3e8CRR2mMfm3V7TdCYiDcLV2FN9Rx4wO9L6AQUo8fQl9P:VzNHz1U3AmT3e8C/h2m3V7Td1ScoFNfZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2920	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2920	AcroRd32.exe
2920	AcroRd32.exe
2920	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ff7994e1aa259278ae6e9274ff890266_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f0130cb2efc0dbcbd62d0be0dd13ff8c

SHA1
4dfb18507ea13a2c354edc9517e64c7f09202f43

SHA256
6ae67deab60a6face03c08179a75b34722da0fea468fa840d94f380a6019cdee

SHA512
218037fafe34ae2d824bedb5fb300e62c54aa1aeb443398a9794545b62af8eece784f1ff0abb515ba1d3b88ebbed9d684da593d6cb2688964fc9b89908b843ec

Download Submit