45f5206c59a0cfcbca1e129ddeae6c2f3bc974860e14d0fca73a2e40bfa96427

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf75a7b8fafe2742eb26a75b508c2fbe_JaffaCakes118.pdf
Size

83KB
MD5

cf75a7b8fafe2742eb26a75b508c2fbe
SHA1

14c5968b222b39b5b96b0289494d59312332ab8c
SHA256

45f5206c59a0cfcbca1e129ddeae6c2f3bc974860e14d0fca73a2e40bfa96427
SHA512

950cf2c484a0b9ece3b558b57e1db426470a19de95a854a7c330907149a364f9bed44639cb552e36d86969a0489b38652bb2430e790285750b24c83ef9f15300
SSDEEP

1536:3m8Wzno39ZxmcxmVrvDEOrnMtmS8rH4r7pVvyXbdLG3F6ySWkza62WcpOmvBY:tAo3VSNEOrnMGrH4rVByRS3YyQa6pmu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2084	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2084	AcroRd32.exe
2084	AcroRd32.exe
2084	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cf75a7b8fafe2742eb26a75b508c2fbe_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2d5d167155114adfeda2b1b8c41460de

SHA1
4655ffd1bdc6c05b77c9db6091a924b677d3dd68

SHA256
86bfb3793fe51a8357060040cdd9362c0586fa7c27fb963dd55654948c26bfd8

SHA512
386c6986410d9c17db620691cde44f1da73766380b364e15d8e31e3c196ebcdf3e710e908392a3d7d5bbe61962f8ed705861094b253baf13c30dc4a04287ee31

Download Submit