e340e428ff12e15e02bfd641a558c7a06cab31e777b472a70da17db3b9e5dbc2

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e1bcd8f6c36b0d123b2fad337b55f94_JaffaCakes118.pdf
Size

86KB
MD5

0e1bcd8f6c36b0d123b2fad337b55f94
SHA1

300d9da8d79886463b3749ecd30f758d07311b88
SHA256

e340e428ff12e15e02bfd641a558c7a06cab31e777b472a70da17db3b9e5dbc2
SHA512

41999ae2cf470899601fd38a18705271386813422d32a8bba3a01356942c97ccee9a85eb5297c86a797ebca84393fc951ce78291cbbd44f3ed60c7b2d056c316
SSDEEP

1536:AwklXkjF4G/V/zb12IGmqj62Ccz5Rziwf5jp/yICXWapOtQ/uUWPEEGZP6bOWi:Ol0jBbUjmqW2CI5RzV5pqYtQm7EEGZPZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2736	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2736	AcroRd32.exe
2736	AcroRd32.exe
2736	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0e1bcd8f6c36b0d123b2fad337b55f94_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7b5f3fae329361590c30121aae4c91a6

SHA1
2952625d1a2bd615d2a0a364c235710f54a203d3

SHA256
58b381124f9acf014f0c9cd41d25a70ad7fb09d2e4c8201f9d81eb00e675119e

SHA512
ebe4226be83ce46502cc8f5efb9957f0f0b49d9110f49ac447bb23eb4e8958ff0df024fe322a5bc9ba36b6c7f74d8fdd6ca8dc0cfc590b69720ff914d77375a2

Download Submit