e95aa730c22258ab88459f0faecb509ebe457e6c8728fb8376d089de436587cf

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 05:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b510bb29c7e3e24a615fa2413938527_JaffaCakes118.pdf
Size

91KB
MD5

2b510bb29c7e3e24a615fa2413938527
SHA1

45a31730307955b27b98c90036d9b27174a7abb4
SHA256

e95aa730c22258ab88459f0faecb509ebe457e6c8728fb8376d089de436587cf
SHA512

323603f14d412b89ded9502500dc284dc61e07855ee60b21e2a23b80b0161b498c3abcab2d895d5e7bae90105fe3e2fc7994673e07c3163be4d72c6d5084d16d
SSDEEP

1536:RkucrlNuHuMQ8BuN0t+itlZbo7liNMEY7aY+SqW6oAoKAKJaHlPLPAWhbaeMWcpD:DOlgS0t+iFb4iSb7aYXzMejPMeXmf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2436	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2436	AcroRd32.exe
2436	AcroRd32.exe
2436	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2b510bb29c7e3e24a615fa2413938527_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
98966f6cfb16ba5633aa0c31540e2be0

SHA1
44f2e8fcd204072bf2f6b543756aeefdb68e196c

SHA256
76c5ced14e3e275abe95455dd4baf54c788748e78e23f99d22fbe88e593944c6

SHA512
649fa503839fe37ebcd6c40de0309d76e8adb98fd03d4771c750d76c0c9350e0e88c16142a3f1c68e26e12384045e49ba27bb78ebdbfe934714f4b0ff9fd6766

Download Submit