ef90fabd10864eae73c8dc1045e0ce9bc738633f512a164441144166dcccd4a2

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 06:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3e4b3653cd84a4b2f501f76fef95f995_JaffaCakes118.pdf
Size

63KB
MD5

3e4b3653cd84a4b2f501f76fef95f995
SHA1

25f7dd0df19788839668995abb8a5204528bca66
SHA256

ef90fabd10864eae73c8dc1045e0ce9bc738633f512a164441144166dcccd4a2
SHA512

26da3b720eb5bc0f59b9d753ff5543d42f2d383cfa404af5dd2f5e54473c4c9a9b81c6d94012e744d86fa2afbe979c22773dbb181f1047c65c80836dc01751e9
SSDEEP

1536:qpfNoKzpMG0rKej82hSCEIEfDhhJPbnqztEOAvfVSDLME3:ifmKaGkKej82hS7IEtGztEOufQDL9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2248	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2248	AcroRd32.exe
2248	AcroRd32.exe
2248	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3e4b3653cd84a4b2f501f76fef95f995_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8f68a46b6d51a0f40a0fa21f311298c2

SHA1
45b6da1b5f4ee057e54b1eb0792fd6864cce0be5

SHA256
c80f78bfedc621ea0c7b51fd5ad2f5f310778cf497ed12d155ff9a75a56c6f32

SHA512
51ae30338fe4d2a3a8fd1eed4164ae212618b7f501f1ab09cca99a528176461903bb8a784208dcda5777565f58f7c464ec11df72ff11e4e8286e65f03613ccc6

Download Submit