e43250e1e25ba07dabca6be1c867c65c5a1869b4d20cab8eea900b60450aab74

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0198784a95a822702a393102721b184f_JaffaCakes118.pdf
Size

77KB
MD5

0198784a95a822702a393102721b184f
SHA1

9a6e4342f76f765a6a7f6aec1bb89848919095c7
SHA256

e43250e1e25ba07dabca6be1c867c65c5a1869b4d20cab8eea900b60450aab74
SHA512

09a5d340511d537a0913e8d9c2935102a5c84dcd304bc053841934f41a5074d95a60df162c9c3a2990d1a97b6562561e7edad4509a623a94da3b254b77d51d61
SSDEEP

1536:Ohn+63ODJzOri4obxr4abZGZbvLe4HGRLWQpOCoWOMvbi8jBL:u3OJOriPaabILe4Hy2C5vbxt

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1056	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1056	AcroRd32.exe
1056	AcroRd32.exe
1056	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0198784a95a822702a393102721b184f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
915efd3281a6b696dade1bfcfab0e899

SHA1
c1674dccca6060b07a350ccb1d559ad4e83e25e4

SHA256
6dab516c0f96051494b3cca5869b11937772524c912fcf8886ea40ad8dba4af8

SHA512
42c261b024338fa527fe88cf53b620d337ea77499960e02512961b8a82ee737c5139054edaef1372ce3b2ba0e0b2c19dcfe68c8fbb81cd6cbb72fd7c61bf8f37

Download Submit