93ed45d5b640b620068dbc5be0ee2d255cf9faf6f4d9af8f8724ac0d1e137acb

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 11:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fa58bc9cfa9d2ad3edded2a5da81b7f8_JaffaCakes118.pdf
Size

86KB
MD5

fa58bc9cfa9d2ad3edded2a5da81b7f8
SHA1

98164aceeec504e99e90f5a1e326a9b3b940df7a
SHA256

93ed45d5b640b620068dbc5be0ee2d255cf9faf6f4d9af8f8724ac0d1e137acb
SHA512

d2f36e38a180b887ae56a8fd0bc2250a93fd6c03d632ba8e5e88a044d209a56a4af74313ee71bc7618a171b82a265537ea304008198030ca46251bd1790dcf75
SSDEEP

1536:G2SGOVwfPT17GW2kmBNMhE+wXj9eJQOjpIWDa9DIqXQh2W8pO7Xgi:+1uT17CDa9wXRe2IpmJIrhV7l

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1728	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fa58bc9cfa9d2ad3edded2a5da81b7f8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d78f41d8a993fdc074e85d9c49191811

SHA1
d4db2e7c4f458b1933da12d15afc303cf8df647f

SHA256
ccb74eaa8ca2f9944c822ef62887591662de2f82102a9237be233d7ebc94130f

SHA512
80b6fd21cdf722ac669a03d2c092f3bdf7fa8274ccce6ef9e0f7dcf7adcfa3282b7042721c3e36b1dc11bbf41b25b4675b3bef9f88a2a0a1ec2b924517b3cff4

Download Submit