674990f0e1586352298dce945e5f8835e19b8e44db66bd7cdf6d064217f8c5e8

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 08:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e484ce3429a3d88d0f5b6e24b1e2a34_JaffaCakes118.pdf
Size

79KB
MD5

2e484ce3429a3d88d0f5b6e24b1e2a34
SHA1

9f26b32b86c8c3b9bf4fcb501e7aee300845c8ef
SHA256

674990f0e1586352298dce945e5f8835e19b8e44db66bd7cdf6d064217f8c5e8
SHA512

87b5f79383822cdd09794a380dd30077e4f81acd7052d4d373ec843b7354fbab0161ea886025c7de10855d2f9a9857cf401062f1c51a24fbd6f50cacf69b67bb
SSDEEP

1536:8WeEchVQycDJOM9ghMJj39epI0Ns8Rc976rHNdPWNpr6EHypqS40UFWOpOZyWdnl:bewOMRJ+Iqs8+976rtANpGEHypqS4jun

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2532	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2e484ce3429a3d88d0f5b6e24b1e2a34_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fb3ffb113398a0b71d2172c1fd38a74b

SHA1
20ccb09f9cc0029e6bc02c63fbeb8590d509586b

SHA256
4552ffd29b2bf987d58845f3c6aa4139381d6a2b91f4f359e5204ebfc5d16360

SHA512
a0952a32111efb2fc75884575c45321fa79b7f1638d63825b947439fbc7af1be7e379914b365601387e4e3b2bba6846385928125b40a245f76b3ad932ff84a13

Download Submit