ddad730b0b476ee60c12a5e211407fcd40cc05d182cf1f2783e7d95862fedfda

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa59dff61e1ff57cba1c3e5ec46f90c4_JaffaCakes118.pdf
Size

13KB
MD5

fa59dff61e1ff57cba1c3e5ec46f90c4
SHA1

01df3a5261f69d6e2edafb3ffb9ec8bc6255451a
SHA256

ddad730b0b476ee60c12a5e211407fcd40cc05d182cf1f2783e7d95862fedfda
SHA512

bb245952be0593c34c38914cc04f0a604dfd054b05d565b1e183dc5f598b3da051575424f56f71f7132561d4c98563f030a30843d415d1d228390dcf1f86c569
SSDEEP

384:Vz/H/AMkz1AVbkmWwiKzNja+gSnsgrPdN1QfPjgc50K4EdQpOKxl:Vz/fAfz1AVbkmWXomBSnsgrPdN1QfP0D

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2792	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2792	AcroRd32.exe
2792	AcroRd32.exe
2792	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fa59dff61e1ff57cba1c3e5ec46f90c4_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a55af26357410074b2cc71bf140d69a6

SHA1
9d5e08d49ec6282322c60ad011c6ed2890f10b0e

SHA256
e6e863d0dd3cdeaf092c4f0716b9eae5c36c5a32776e7aef17b91addde6dd341

SHA512
1572fcfc5d1e0ebeabf3416a08347fb1ca6afe6205f87450f1a4a434cc497a5cc0a13685a71aa519e029a289df05ecd3a48cee61629bbcdd98d115219c5a4a28

Download Submit