2fcaf43f039dbbdfc0e2ec72714d036fd1fbf9195a31f2c86514af9cd8dc8904

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d6fa4e76fbfb8285e3fe751d61589cc4_JaffaCakes118.pdf
Size

33KB
MD5

d6fa4e76fbfb8285e3fe751d61589cc4
SHA1

b095f50bdcfb3e990c9482d39bd5a25bd9994372
SHA256

2fcaf43f039dbbdfc0e2ec72714d036fd1fbf9195a31f2c86514af9cd8dc8904
SHA512

1f1d63372e4794499ac75e97851722b7d7e7939cc6551e99dad5d42348f3175d76a6fa26b0a442610342fdc7310a5e46d4115c77ba3a9a58c75d94b6ea219f1a
SSDEEP

768:7XuMZmwgCLWarME5Hpx2Y5YgGveh8+wVt53b2Zbl7AYTqlP2:7XFZmGWS1j2Y5YgGveh8+wVt53bm5klu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2128	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2128	AcroRd32.exe
2128	AcroRd32.exe
2128	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d6fa4e76fbfb8285e3fe751d61589cc4_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a49a33d2c3ed92515133106e7b823ebf

SHA1
37b3e2d4e2ad560f017f8dbd65b0d29813fec149

SHA256
c79952b36f56ba77bdd35707581e48634e2e63068a81092caa9bdf589c629ffa

SHA512
49a8bc30c53b9d4612defb1414803332d77280bae99744f7077760f0458e90a5b94e8acb7037293aa669baa92b49471f5942222e84e536b0a69387c0876f366b

Download Submit