b05ce65f4563c15b3ee5aadfee8f59e2a0bf59d6e5bc5134d2adca4d79bfe5f4

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fad82f1a08a5d3fc24e9fcdd73c721fc_JaffaCakes118.pdf
Size

39KB
MD5

fad82f1a08a5d3fc24e9fcdd73c721fc
SHA1

5a12659252894c4e93ef6bdbea7536b925099f83
SHA256

b05ce65f4563c15b3ee5aadfee8f59e2a0bf59d6e5bc5134d2adca4d79bfe5f4
SHA512

0d60d04656e44432ad56db439253356cb288dc2f51866e4a7a4920aa5fbac430f6d22660eb41c9cde82f90561d37724500150e4a3ed5e3cb3517d461583dd778
SSDEEP

768:dXuMZmwgCLWarMzE5HpxwveNAZcBmQ6oNZuadJIEyB73/Rb2votcyuluuEzAzI1T:dXFZmGWSJjwveNAZcBmQ6oNZuadJIptv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1932	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1932	AcroRd32.exe
1932	AcroRd32.exe
1932	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fad82f1a08a5d3fc24e9fcdd73c721fc_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5c52c75190bcc2eb8a34a1097f4fb105

SHA1
82dfe458c02dcff35dcebb19fc5b2888443bb933

SHA256
7a40d7b98cd747da0e591763eea78079d3a8a75c3be978449ca088b1009afa2f

SHA512
85251b5f40a99bdcffe418f08e7b93d5cfb47d056514ec3ac188f733f268c6f162c54bf62e060461239f967111addf7d2c7e06df26e085ae6c6fe2826159eaa4

Download Submit