f66a9ae94c5c1ad77787dc66e56a2f6c715dd9c423cbeea046ba2aa23456368d

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f0a7619ad62b2dc58db223a45cd81cd8_JaffaCakes118.pdf
Size

40KB
MD5

f0a7619ad62b2dc58db223a45cd81cd8
SHA1

cf83f8feb47e632a3c8b40489182020652085964
SHA256

f66a9ae94c5c1ad77787dc66e56a2f6c715dd9c423cbeea046ba2aa23456368d
SHA512

4a242f417bd467eec0f85fe76de9cf53170ab19e9638afa71c01a7b6914412f46513efdd7842a65c8e3a9ef56ff13058c64664f4e72d1c7a9fb071c2a94daf94
SSDEEP

768:ngGzpDTpG2wUx6Ylu/rdNMGHtpOSc+gJEC9QAlZxI2jvAQLgRiEb48Rxd4hW2XtY:gGFHp0Ylu/rdx+arAHK20QUoEU8uhVXe

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2548	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2548	AcroRd32.exe
2548	AcroRd32.exe
2548	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f0a7619ad62b2dc58db223a45cd81cd8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1b1c474a33639ed37e610de98c14ff42

SHA1
4e359105c2b67d9e165a307eb6d88be4eaa7506b

SHA256
127d0201fe6bd38e3dbe4b4d9e060d200d3694336955e4c04563a1efd168456c

SHA512
aa9b1f8b57dad29cfc584fbc354d2f89ecfa689f940ab1a4c68b7c7c8a90c8bdd440bd06543c86cc5c8fbc97a2115de707ab65e55567efd509f039f62bca6a81

Download Submit