eaae2d22627cbb16f0bfe7bff88d41ea639c62dbe9974872887b025c2cc07d6d

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e851b79ec65d57c4c678604905816d4_JaffaCakes118.pdf
Size

76KB
MD5

2e851b79ec65d57c4c678604905816d4
SHA1

a9ce1689ceb214f4e2f4f4c0245c3547f14b431c
SHA256

eaae2d22627cbb16f0bfe7bff88d41ea639c62dbe9974872887b025c2cc07d6d
SHA512

2509372acff0cc24ed0e0df7dbb2424a6d09badd5bc6e795578e7b886ed67bdcd330b50b7ec24d25f4f714b8f41280de5a4abf6eef5cb240271f7551bb56b83f
SSDEEP

1536:m/nXyeCJzfCIn22OkTMiIfdtdKe/1HWypOlWWxROlME9P72CwjV:0vCJzfCcO8MpFtdKAQlDsh5CCC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2340	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2340	AcroRd32.exe
2340	AcroRd32.exe
2340	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2e851b79ec65d57c4c678604905816d4_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d2fdf53905f01d671dacf21096ae3c17

SHA1
14e8896d160ec69d4c22ed1057224627d9e77f68

SHA256
0b0fc0b9aa049ffd62de0182139ea6f0a9fdaddf4ce94a6cef1ef0989fd3aab2

SHA512
d90910e1480f63db02307f539fee8f9a171b4f8d38562ca6d6ff36013297f7f6f958d28b59166a700ce75b51f599606534b443156db8ccb2f1d0f3d4c26d29e5

Download Submit