3f8756f453449595791a6281a587b694144eb78aefa69a5f73d5b4e626f880f7

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/08/2024, 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9fe6af7d8b5fa02f0df8b49ec210fdab_JaffaCakes118.pdf
Size

81KB
MD5

9fe6af7d8b5fa02f0df8b49ec210fdab
SHA1

249aa60b0916bbb3f9490afeb6a3e6ffc8b42a7c
SHA256

3f8756f453449595791a6281a587b694144eb78aefa69a5f73d5b4e626f880f7
SHA512

221d5d59d00d18497ab076441d7419ca586e11aefe410dfadc57c9907d82fc44709bcb363b77de50715eaa99f8d96ee142ace302bcb5118acce0d0d425fccb92
SSDEEP

1536:KFBr+ZK3TWIoP80a+21J4+qReLz1MW1rfop41WRHvsBT1DAxWOpOaZzZ88NfFBqk:Qr+sjs0LrqRAzbhop4WyTeqaZu8xl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1072	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1072	AcroRd32.exe
1072	AcroRd32.exe
1072	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\9fe6af7d8b5fa02f0df8b49ec210fdab_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
48e2a7793378e50c86850742a665e14b

SHA1
ef5ddd6b15b067c99a53b32916305e3509cb8600

SHA256
b07041fb65dd19c79deab80d353859f6150e634fd30a537699b69c92d9bd46fd

SHA512
689b356cf4c4011fb8560e9f47f29a57a4de12b35acb375de5a8370efb4c30049a46f7ced5bd6b676df4562a24387666458f4515ed40ab3f8f21b7162478a464

Download Submit