d8c2d381146aae3fabf5eb843f7c6ceae53f9ede9d0b86cf32d20a12f838d7e2

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e0ab288a905fcc3adbc7dc55c7d379f_JaffaCakes118.pdf
Size

75KB
MD5

2e0ab288a905fcc3adbc7dc55c7d379f
SHA1

839b2d2f5059186e877359876551856176af72ac
SHA256

d8c2d381146aae3fabf5eb843f7c6ceae53f9ede9d0b86cf32d20a12f838d7e2
SHA512

6b1c54d26881593e7ddcdcd39a7a0ce4192efe5e899509ef4b6bfd53f00746d0c9b6b30a7f80ac2e709f52822a5ee97bf3d2c683c9e3d9d7085df8895e2e6624
SSDEEP

1536:lT/hr0JgCB5QmLDPMN7CWCdj6wO52dWsD+L+FYbaWOpOwrLuSU9FH:9heH51LD0N7hCdlw3yFsPwrLbUb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1732	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1732	AcroRd32.exe
1732	AcroRd32.exe
1732	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2e0ab288a905fcc3adbc7dc55c7d379f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f4c1d8b4dd51088580896f1aa1eb4d24

SHA1
3d86cb7fb7c35e74811e90819f95ee7870937a81

SHA256
91fe0d8d364268ff05bcdcb32c387b5ed5f6238df41a8106d1e089fc05c8550d

SHA512
332f499ed0d30e621aa718c3aedc7f213beb4230a1414865685a349cd4ea16d33b9063b152befe1541d6ec5cac75f0dba9e0bf53f4fc5d006f4d9418498a4e4d

Download Submit