b5a725b2614fa06b838c20a54041cb5fecabf445c3152756754f3f937b7e7d49

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f67bbb1592dfdac485b417d543a5869d_JaffaCakes118.pdf
Size

81KB
MD5

f67bbb1592dfdac485b417d543a5869d
SHA1

94663e451c5a3c418cb7da3cec541ef73201947e
SHA256

b5a725b2614fa06b838c20a54041cb5fecabf445c3152756754f3f937b7e7d49
SHA512

e2730c7463157b80806cb387eeb74ef7339d8a4cebe92f986bcf8407cfb799f96423fb40e44b089a40dcfbbb96316d46bc57f86ca6d2449dafa531ceb2f7b10b
SSDEEP

1536:4mRqPHiGxzqaDFzI6mXkZjvTHbXriSEVRCRMTW6pOu26WwdrJ4o/XWLsOJZwx57:zsHeaJzI6mXkdTH/JEVcRMYu2qdriEX7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3044	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3044	AcroRd32.exe
3044	AcroRd32.exe
3044	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f67bbb1592dfdac485b417d543a5869d_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
46533ee206e123bae9b46a21f9d202eb

SHA1
386637cd3ca81d4a185237f4bc8a2a489cd49483

SHA256
7db44f8b4f04aa295e190f7730568f35dad815e03e3579c2fe99fa9c8dfb3794

SHA512
e7ea5fc48c7c4bd8c8fed1f6d9c5614737be2ff55412593175417156366029dec5ab2ea1beb70b5aecc74d261bc9f513b9624ad3c72f8bffe7688dcb703049c1

Download Submit