9e79ca9998c1bbff545d5725876caf33772be0c7579e2b08f4281b4b2cf5365a

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2def74795ceda9cdd9ebfc2c4dc48ddb_JaffaCakes118.pdf
Size

72KB
MD5

2def74795ceda9cdd9ebfc2c4dc48ddb
SHA1

bbf535a721f15d6fc441e27c720cf2111dbaaed7
SHA256

9e79ca9998c1bbff545d5725876caf33772be0c7579e2b08f4281b4b2cf5365a
SHA512

2f11164734ab927cc755401483ad5ff331272452bbee4fb320cc2ed2a742568fb974438c263025240e9872acbc42fdc09d167c343c05ebb0a6ebc60bfe255e1f
SSDEEP

1536:BMaWqSS0InqWh9wRNwITJifR5TXtXOvACo3k9uzkq+:jWqSvIx9Jwi/t+vO0Mzu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2344	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2344	AcroRd32.exe
2344	AcroRd32.exe
2344	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2def74795ceda9cdd9ebfc2c4dc48ddb_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4c4658d84fac38307b3888ce5f04e2bc

SHA1
868dfccf231bed15a96a1082ecd84e0a218b15d3

SHA256
c80a9c8e09d9b245575050f2367a8befb4a4e3d0d28e9b6e0223406fe07dc361

SHA512
227502144698b543c40a900faa6a8a66501e7cc7660b2f5679e2aea75280f25d289179383e7cde0eadaa06c5d5dbe4e28d6ae52fd236c102188c469fb7aab5d3

Download Submit