7f5e5737881c58d21270f3fd573a535c81fdc5c82298494bffd914703dfe3441

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6a0f4aad0f15c3fddbdbffbb9d0b5bf_JaffaCakes118.pdf
Size

39KB
MD5

f6a0f4aad0f15c3fddbdbffbb9d0b5bf
SHA1

fe55b84a5cc49e1523d0c191dd797e8e6f3ab282
SHA256

7f5e5737881c58d21270f3fd573a535c81fdc5c82298494bffd914703dfe3441
SHA512

a9a266fface4eec73831743779e7abd92d0f9a2621af32fa64a772b378016c249f0b76affcf968a2ab44c8ee9aa48744aa3defffae8fb0beed695bc2f4edcaca
SSDEEP

768:HgGzpDLph2FfSQqXzDK8Hrx3eR/bzW0H9sivbW+OsiTi2+ngyyIi2IVU:AGF3ph9KDK0LW+pzRyIi2IVU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3012	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3012	AcroRd32.exe
3012	AcroRd32.exe
3012	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f6a0f4aad0f15c3fddbdbffbb9d0b5bf_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cb1ee2d5f44c670ad23cd9654bba7c5f

SHA1
041f14420f86c3762c30f8c298462cbb4f9c6acc

SHA256
bdc12f49669a3afeabe00f3021eeb098116f673cd2774512b98e3a20804e3506

SHA512
e2e4502b55d532ecea33660decdbe8c09e6b776531ac1cfe18ace43d90380f56655c96234a560847f6bd7140e413d4ac6ebbaa81b755f6835adbb437d239fd8f

Download Submit