f4e13c1ca9f54edbfd19e8f20ff0e37c413347cb706806ae08c6986089d55fb6

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbdeb4103b94e759a98812666adee0fc_JaffaCakes118.pdf
Size

42KB
MD5

dbdeb4103b94e759a98812666adee0fc
SHA1

75990310484bac980050c1770166d588327b4275
SHA256

f4e13c1ca9f54edbfd19e8f20ff0e37c413347cb706806ae08c6986089d55fb6
SHA512

173c0e43288ca3c6d1477dd4475a346d79fefa004787f71e44e27efd38ebc960466837e86cb28a7863eb524852847b78978cea2cf2adf1a924f1a7fe2250153d
SSDEEP

768:zgGzpDsbpnnfyF4jnVtQBFig0CQpWZrZ5kZVpYRiA8yVb3gkT28uF:MGFoJODyNWZN5o7YRihKjvT28uF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2616	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2616	AcroRd32.exe
2616	AcroRd32.exe
2616	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dbdeb4103b94e759a98812666adee0fc_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
25f6a4f0e0d437b1b0f5e042ae5e8570

SHA1
92180e1ce468797b8f5e8637ea9cd7eeb488f1ac

SHA256
5e7de858a3c91202503876fce8d461b4006f781652beab81c76d742559604bdd

SHA512
56dbce1138be588e2afd8b2c6123c656764f1747418facc99a4205eabbdb7f9e77dba7635debc8fb5209c94d031a999374d3fa8321aeb2dca6751116393e071d

Download Submit