e13d1e03ec1a3a1929d8c1dd8c885582010d68bba24df8b9b9eb2a4e35dc9d9c

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 14:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

01e384f0798b620199c0c83605433728_JaffaCakes118.pdf
Size

83KB
MD5

01e384f0798b620199c0c83605433728
SHA1

95471850a40949444c7371bf029be87b009dc31c
SHA256

e13d1e03ec1a3a1929d8c1dd8c885582010d68bba24df8b9b9eb2a4e35dc9d9c
SHA512

f03f7371982d646a173086d79b56165eaaaa42870699a22949087bccb1b872c7bbae09b9ba8cbd05140e61ff8a5fac723ad9c99d646a5cd7186e932933316ba7
SSDEEP

1536:qW0spJxJ4TI8mkrAQaljU+mNMhYqN3bXlgS2r5jW7HD6Sa6bbKWelM:CspJX4Trh+mihrNrl0pW7ja6bbFt

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2508	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2508	AcroRd32.exe
2508	AcroRd32.exe
2508	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\01e384f0798b620199c0c83605433728_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f891f858fe68588d8bca9001508c15d4

SHA1
2dc7dad2e3931088f45576bd482f2c7c7c72045f

SHA256
2a2c4e4077216ae00010e140deb8f7231a95b58bfad7172436b820fb04cd8518

SHA512
df2efcc8482a44a2f5e295352b836964d1e6ac813547e8c85be5a33289b2e4106519bb343c3bcc367fe64444ecb870e4ff333e2948802c34748a57e55fb07423

Download Submit