2e869b5b13cf932dc09982cc6743554b247db595d04a3a1e35b588cf99a14c8f

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

126a5a2b1395db24e11ad5cd34eedfb4_JaffaCakes118.pdf
Size

39KB
MD5

126a5a2b1395db24e11ad5cd34eedfb4
SHA1

d256a1ea06d9831c20e1828ae141208ccdf09c3c
SHA256

2e869b5b13cf932dc09982cc6743554b247db595d04a3a1e35b588cf99a14c8f
SHA512

2df3567e928acb604cd4ffad19c50739b1e7a85192c933ef5ba25160e82373b3a5b19528dc2b24386cb9a25b3e2755659efbcda8a88183ed81b265972c36b8be
SSDEEP

768:3gGzpDVPOCvSZF9MD2veRmIn3PS2Ar5ce+3rWlfyvog3:QGFBmeZ3PS2Ar5t+bSfkog3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2424	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2424	AcroRd32.exe
2424	AcroRd32.exe
2424	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\126a5a2b1395db24e11ad5cd34eedfb4_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5f4d98576b78b7fc043eb8516cc17d86

SHA1
6ad214dc5a03a05360993d22931c4e796621ee45

SHA256
74fa4dfbecec96b7882fd4aa63ad313cb3d5b11affe759bf495100542ee68e0c

SHA512
d1af6c383e7f0876fb48aeb417c4c01e202c0df2ceca538f3408c9972cb213473efc86421aeaff9fb55afd50aa5bf6e4d3e7cce8dd84739cbc85262457659d6e

Download Submit