e0f99b730e93e1c04b02e3aff00938f398cd14ec1149d6408333f1e39a02df86

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb6bbaba27499b42376579ac10211e78_JaffaCakes118.pdf
Size

15KB
MD5

fb6bbaba27499b42376579ac10211e78
SHA1

1b82d704c2aa8a933abfe53231416661d1946566
SHA256

e0f99b730e93e1c04b02e3aff00938f398cd14ec1149d6408333f1e39a02df86
SHA512

03d49b8dc363a31969b65a6f1ad7530f3f649460fd8d0c22a25310b2bf2de2d6c9b5dbbef4b0c9a1133e69ed5013cef0a12270a115617e29ee5c9d7183375e4d
SSDEEP

384:VzEAciz1px8qHCEyKJNK8EjA+2qawYyPG/zi+6xRoqAauedfQAWwo/KspQYeXrg6:VzEAciz1pxQPKLKjjhTOqGmXxMydbVjD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2524	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2524	AcroRd32.exe
2524	AcroRd32.exe
2524	AcroRd32.exe
2524	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fb6bbaba27499b42376579ac10211e78_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
42ce6b39fa8895d29e07480dc011979d

SHA1
5fe0f7ed037a97b6b495f045dd4e84b8f7809e2f

SHA256
bdf4351528a235d491c7f14e12744bff14068fb5851d13db3e866a970afe50a2

SHA512
74e0aefe7d4acd76d55abc03a8bbe3e89c432fccd25bfcdd98016b81a3f3db4c16545a03a03aa25f16249536669e384490bdaab90a6bba0eefeea06a97d7d147

Download Submit