42b8e3ae4e3defa372adb81c4f5def021ae90fceada071aa23f9e6b18e4f47a2

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa2535ed03f44fe64b000faefe08cde8_JaffaCakes118.pdf
Size

44KB
MD5

fa2535ed03f44fe64b000faefe08cde8
SHA1

0584115ee865bc6d0fe05f12b5824d3b5d802dc5
SHA256

42b8e3ae4e3defa372adb81c4f5def021ae90fceada071aa23f9e6b18e4f47a2
SHA512

b5fc94b85b0dec57358a73a804694bc33429f57e1e60de1e2a7e0350d7661f3d94d3bebe47eaf759026faa0d7b633a5a0f4cd74b1f75c4c355a0b164fe06ce3a
SSDEEP

768:MgGzpD9eC/bmsZd8X/NNQjii0UnzNzBqyaRckAS4RKwB4sKubCFCD75yErMCRD:JGFpeZUnzeES4RKwBj99D7BrM+D

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1800	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1800	AcroRd32.exe
1800	AcroRd32.exe
1800	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fa2535ed03f44fe64b000faefe08cde8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
45dd997d2c605cbc50669de740e1ba28

SHA1
ff5176c8a849c37a9f38625826e2ba1cfdfd2113

SHA256
ebd600e7e343e2f25fe17fe5cfb944a0a3ae7a34758796831520acdfb36df463

SHA512
f84269c9338975b2178324e2113122803eea1473173a9c5c6a3c2c5b666fd7f5a99a23a09f4e0b6db4625212312082824c5f8df6a6121077d61f5fecf49b4031

Download Submit