e10424b63fa0f6e254b17a5b251d13f3f038ea05d9f07d6f76a2077fd0c357d3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2a3b7bc69f3132ad2ac41ff634d5a1dc_JaffaCakes118.pdf
Size

82KB
MD5

2a3b7bc69f3132ad2ac41ff634d5a1dc
SHA1

2b447567ddc20149f3775596023ec3c7c08cbaf3
SHA256

e10424b63fa0f6e254b17a5b251d13f3f038ea05d9f07d6f76a2077fd0c357d3
SHA512

2c6e4e9bdfef66a5c7e01b4197458575bf06a32f8feb077e069af69e900266079caf6b6e9e02272ed81d19e9f453b8beb033bb9215b7ffc67b133738f02f0a27
SSDEEP

1536:2GZiOUXLRilh3taIytesL0l8ubRt426CYHtv9NaEayyv043W27KOv4NXdcA8fYWt:lZzE83tZyHwTbP6CYLNauQP74N0fHCud

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2492	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2492	AcroRd32.exe
2492	AcroRd32.exe
2492	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2a3b7bc69f3132ad2ac41ff634d5a1dc_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
da2f30b4a332ced14dd864c8dd099b60

SHA1
baba3abee983ae1b2af842fd849d5e5012d4c216

SHA256
672a38cf7b0cf6a39e210ffe8f3f30a4966c91c5ce84ab74f8ec4694b9f2a241

SHA512
4e1700c6703a92df3ec3a654cdfe4b6032e9451103dccf9a39334783846f59b005dd84ce9c1d51dc4ab878f75e8e76ff8cf580f17bcc129792a3ccd221349ec5

Download Submit