fc73f5d97c662b2dfd4a1010ddf1bc9df785e5a1c795fac913277b993a6dd2f5

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0ccf54e64c0ca5d075ba7b0a3932251_JaffaCakes118.pdf
Size

79KB
MD5

b0ccf54e64c0ca5d075ba7b0a3932251
SHA1

98fb09319fa15da1ddf4a61699678deba61e772d
SHA256

fc73f5d97c662b2dfd4a1010ddf1bc9df785e5a1c795fac913277b993a6dd2f5
SHA512

50eab7eca489680c23752ca023f1eca191065f2fa46118279686ae7e3851774ae4bdc30ac396afe6f8d1e4afb014588a4b52e05e17e2bc9b4d53eee5640b2b9f
SSDEEP

1536:XiH56UKUWKovXHYzPskXN0S8H0NbAQ9vNwTmS07rW3+ZUIAEKisLgGD8NNdQOt/:SYUKrPHYj5XN0SvQ3kr+REKNkGAQ0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2220	AcroRd32.exe
2220	AcroRd32.exe
2220	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b0ccf54e64c0ca5d075ba7b0a3932251_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0a673ecc9d5851eddf9ef3eff02d34c8

SHA1
f264d30ea8c1622a7197959c045ca68b7e870fe9

SHA256
1d4ff8e9f75bc9645806802fb5d6574d1d081b9f83c657d186d3216e7d1ab326

SHA512
8bb57e42d6fc4e77a21d921806136528975185ddf35fa2099dfd7497b4cf6fccece2ab3bdb6514a80aeb959e8ac700c9324790ae52b25ec357a92c6fe337f761

Download Submit