30e53f2bc8f2e8f284a652059ad3fd5c7d62d9e4975ed691eade97ee83906f8b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 09:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbfb4996bd1b723e41b79affbdc96370_JaffaCakes118.pdf
Size

75KB
MD5

fbfb4996bd1b723e41b79affbdc96370
SHA1

49876d6d5783e89b242e17798f8a140bdc69408c
SHA256

30e53f2bc8f2e8f284a652059ad3fd5c7d62d9e4975ed691eade97ee83906f8b
SHA512

1cee4f1265726e44bd155b87ddd2745a1c33f6be11820fda5c065d0d55c79fd5ca4bfd68ec0cb0598009282844dd8690ab2e824974609b63e750b69bc0eb2a61
SSDEEP

1536:VPiTHc6gmwKpr9m807YGHeLxf9FA22VVHWQpOCoWibAs/belBh:IFhAaLxf9eVVyCybAs/be9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1736	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1736	AcroRd32.exe
1736	AcroRd32.exe
1736	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fbfb4996bd1b723e41b79affbdc96370_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
57220bafc9ebefa62dfd406c823eeccf

SHA1
7b7727bb24c0c92a5d923c442eed43285842fd8f

SHA256
8ce4664f88b8fde71693af4f152b851614425be5d0f28b254f3d271af36dd7b1

SHA512
3a86bd2ccbee1d61e00247541bb56ae5e6eddf38c95c58c57f782394ad8334702483af69765776bf2c6d0cf95850b88a580fb1c7fd23e2281d46bfea7196f683

Download Submit