6a6b82e37ecd0f4d6f24045260b4a574fcbe18668be8af600c608f02279fd424

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb5d4b044c42de1515ddbaf7c674b515_JaffaCakes118.pdf
Size

46KB
MD5

fb5d4b044c42de1515ddbaf7c674b515
SHA1

0ff60d9ab714e0a3175ccf3c7a0c3d0fa8d94de8
SHA256

6a6b82e37ecd0f4d6f24045260b4a574fcbe18668be8af600c608f02279fd424
SHA512

c6878206ed60f70586be19bb9c8d499e570cd13585c810d5fd5b709a86e555c380022c77ee75764ffffe9af7934b72e272557119ff174288560667f286e2cda9
SSDEEP

768:YXuMZmwgCLWarLE5HpxtYZ/aZve5S41tgjPp9ZfFaoV3SOpcq+VhqVyGr3KRC/4e:YXFZmGWSEj6Z/aZve5S41ts9fFJ3Szqh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2544	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2544	AcroRd32.exe
2544	AcroRd32.exe
2544	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fb5d4b044c42de1515ddbaf7c674b515_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
550e9be7b2a9d5b1d65620b7a2d3d8c5

SHA1
3c0b027e4f20bf019975588197521c6e8d633e8c

SHA256
2eeb4be6a5ec2ad8b3b42cebdc283685b3cdacf9eb54192667c9ca1ee85a37bc

SHA512
68c406e0a557162050ecaefd1807af45adbefa405a47ffc8da9067ac4ceba1006622bb69341690bfadd9babee919ba3e688bd78bf1ddc5f909e19c91650ca35c

Download Submit