4f04d0170e3fac575c86dd72676bb44ec72317b96f3cef1c7066d045099ca7b8

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75fbb7a9f29bc0dcc5876a9bf916b949_JaffaCakes118.pdf
Size

86KB
MD5

75fbb7a9f29bc0dcc5876a9bf916b949
SHA1

4c9fcd153fa330c7421d096cb98c998591ff9ea9
SHA256

4f04d0170e3fac575c86dd72676bb44ec72317b96f3cef1c7066d045099ca7b8
SHA512

a2623e64df9cdae7b43c2c49c67e3b952eedf0804d6cc67bac55eb2e4e13cf6cecf443f1c870ddf33d4464f832104bf91bb35ea9bdf2ec32868cef6475bd0939
SSDEEP

1536:3wEuB/guwdjTCPeNGxII/bgDCFTcMut92Tjh4FemW2jSreXHZGCGWspO2BvOf:ruZLOT+eNG4eFoEhL0jSC3Zvl2g

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3036	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3036	AcroRd32.exe
3036	AcroRd32.exe
3036	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\75fbb7a9f29bc0dcc5876a9bf916b949_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
84c5b4c2722bcc947706485ff94a7b00

SHA1
bccfd857aedd2fa07a6f7edfc4e940e6bf648aa1

SHA256
1191a50056f0b33597fa9e622556051f2cc0fccf904b5980b36a8ec0a22bf344

SHA512
7b55ab0ef3d100b36cf5077a81c37c5f75a5c47b81906e4f722cd160712b9ba1e4109f19228661193b9fa26214935655ec3e820943d73d633940c755bb3b5c72

Download Submit