b0f38444441008d5dc649f69d571052ab0871b1f6f802fbbef0324960e0c7d92

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f016710cad1dcf5cf627c8e95fe80aaa_JaffaCakes118.pdf
Size

42KB
MD5

f016710cad1dcf5cf627c8e95fe80aaa
SHA1

4208f7a7ceb5b8e3bf87fe44c46a2971edcb0b3d
SHA256

b0f38444441008d5dc649f69d571052ab0871b1f6f802fbbef0324960e0c7d92
SHA512

bede98afbef9068053dca188a08d502fda9b1bebfb38721c56707979b8e3fbf780509b6cd91ca97defa5235c9c6e825fda5dbfe95ae827b226d80caefab0bc8f
SSDEEP

768:ngGzpDkespw4MzMdRMeW6C1v5FUeriYlJiamliENvQEC4NAVpsR1T/SNX:gGFwe08/rFlJklXNvBNAXsRJSNX

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2420	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2420	AcroRd32.exe
2420	AcroRd32.exe
2420	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f016710cad1dcf5cf627c8e95fe80aaa_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0fab5fdce0afe371219bec609e970292

SHA1
bc400f34bdee959b19aa2e07e66e77e40c3abb50

SHA256
a02fca7633ef3fee51e8e6a8a798494c8dab93bd3b7fbe757b959c22edaae3e9

SHA512
ed19ed5519e48785493035e8da2197c78bdd68259ee7424ff64e345e56a5ca2c92cace9c50e10e4ae4aa4a93aa355fd87168d1d7bdc77a274a9d2999a23d8830

Download Submit