ad12cefb74003a410880332bca4bea52cd4252f59e9db61baf6ed78d287aff30

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9f49b003fe54ffd74b0b07fb3f2d5bc_JaffaCakes118.pdf
Size

43KB
MD5

f9f49b003fe54ffd74b0b07fb3f2d5bc
SHA1

c83118c55ef2848c5c20b297008c39a9355c6812
SHA256

ad12cefb74003a410880332bca4bea52cd4252f59e9db61baf6ed78d287aff30
SHA512

b12151d2e80518cc0deed45e180eeaf39b7e6b3a5b358d1fce0bbecc6941f80524f8621e557b4ec3bdb3c83d3ae79cc7728ea763ebb1f691b1044bb00efee2fc
SSDEEP

768:1aHOL6Xztr9sf9dHTOVQ0x6mqofxdB09E/D67isKYtNkyQXqd2Fk11168RddQ:19L6XZpslhX0ioZde9MAMDY2Fk11DdQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2300	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2300	AcroRd32.exe
2300	AcroRd32.exe
2300	AcroRd32.exe
2300	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f9f49b003fe54ffd74b0b07fb3f2d5bc_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
47046e7b3a08a52dcefddafce549384d

SHA1
a9da221ecb6654e59fd1a076938a3538516f5300

SHA256
26a91ffd3d49873bb2215954de47963655e132e87eb8553b3173ee021127db2a

SHA512
3a2fe31224d909217b2d9288afdcafac4ee542df491a40c2f38401f73c4f566c12ea69aee79ac40f24a2b336606a3d04f5fe1cef1853927ce3c19557ef0198de

Download Submit