1541a1c5c588594612474dbdc369fd002c7695c88050fd80d625146996cdbc39

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

facfd2d8f278c974c60ace57958e339e_JaffaCakes118.pdf
Size

79KB
MD5

facfd2d8f278c974c60ace57958e339e
SHA1

5c63c8d8305a2fb2383b7aab683d0291c6b82be6
SHA256

1541a1c5c588594612474dbdc369fd002c7695c88050fd80d625146996cdbc39
SHA512

e8d492b67435a24f1ccb9a81f5aada4584662e7f0706f62a80c876cf4000c21a8df72481cc74799d98ea38625d9ab26f47f75d709ae66d0329a9f861a8049108
SSDEEP

1536:of6LdcO6FVd/W8xudxHqq76lAGcYb01Q+fD2yGo/+SH1PMqWtFhDeHKEfDbwZWbu:HcO6Ffe3xHqXAGVb0++fHUSHKTC7Dbwz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2084	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2084	AcroRd32.exe
2084	AcroRd32.exe
2084	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\facfd2d8f278c974c60ace57958e339e_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
26228eb2b3e7edd8fb2513a8f70fff7a

SHA1
7c4e894e7b1e5d1be44f06de011b0ba61206fae0

SHA256
2ab8c1c88efa6c5097e391d4eb0c05fd20d38c68c06d174f4842ec97ebe74ac1

SHA512
2ea5d3a4a36c968c3ea411527495698e6b71751a3bc34e2e21060ba0f505ae329ccaa49225b650a89692301f17873fcea15d3158f9d56e274af8b83e2f53e27c

Download Submit