e5bfb17c76c7ad67649c74b0b42c3110218527ed97139e59219c0e3eb28b618f

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/10/2024, 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4567c95621577b60d0c6152818efc7c1_JaffaCakes118.pdf
Size

79KB
MD5

4567c95621577b60d0c6152818efc7c1
SHA1

b126af709652c3feb65684042f7481ce4d895233
SHA256

e5bfb17c76c7ad67649c74b0b42c3110218527ed97139e59219c0e3eb28b618f
SHA512

e8f55a9ec26b5094949907affe10c46d4ed7a765509b13b6905228b362d2e564d60acc4466a4d7bb896e8aabe4114bcef493c11607cecea2110df61dd2419811
SSDEEP

1536:TJBPkqXGhyGO0FyIvDtFEVcjYDAIT2cpL9TkECC7qJRWP7GOt0ABQb16:lBPhGEGX7/sfAxsLaE77qQSABd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2532	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4567c95621577b60d0c6152818efc7c1_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d993920e8ec8858bf76735b8070a0a58

SHA1
a6dc7f4cb8a8e6af45b2c05194b848e075849597

SHA256
7e0356cb54e466d7874a4442bdf6b752b17c2c9edb91c4725319c40613f254b9

SHA512
e3e4810d8d8cd4fe9b1f8aa3a147b5c5389ae0ccecff39dd1486ecbcd053fe6c065710b6796fde5c5b9a2dfc5e6f7c976d413036a5dad0a035c7c8900de60b53

Download Submit