4b345f3196ffca0e3914f5f69607126d0014912d884ada8dbe0695873b33f187

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5c84ed68195ce563be299f46f75e5cb_JaffaCakes118.pdf
Size

47KB
MD5

f5c84ed68195ce563be299f46f75e5cb
SHA1

150a77e0db13e1aca145da1c1d1a254c4f8056ac
SHA256

4b345f3196ffca0e3914f5f69607126d0014912d884ada8dbe0695873b33f187
SHA512

2cbe08c57be738c9b37916df84fef0f02d3061729920ec4fda483a7b3a8c79eb6c12bda174450233f0a3e80cd2108931250e4deb06ce2431fcb4d7a7f6c53b17
SSDEEP

768:agGzpD1p9sQ8kF9RSQ7EjHtUvoOFumrghvcnaMQDn/wTJDauA5t9fAofepDgj+rs:HGFxp9nSZ6uTiQ8TJDrANAofepW+rdi

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3028	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3028	AcroRd32.exe
3028	AcroRd32.exe
3028	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f5c84ed68195ce563be299f46f75e5cb_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e11b147cfa41e2578f55a0aa9b615e63

SHA1
b01720b3e988d1bf2cc00569db19bb565ef0310a

SHA256
7fefac748063906e0141ae4315e390ea2bb8040676f34dc8e9908cfa88d72a71

SHA512
cd2adb42a0a5444421335233ab22d4dd41a69dc4434762a1fd0dbec48fbfdd069c03d2217b57b52e32fdde11543df4e5ad4e4d5d86741327336408164c479dcf

Download Submit