6718cdee3f26f0a2216c8a135d8666bfe3232d02a2792329e04834726bfa5e3f

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbf1752ad63a66e8c16536b443bbf7bc_JaffaCakes118.pdf
Size

34KB
MD5

fbf1752ad63a66e8c16536b443bbf7bc
SHA1

46317123023940911e5f1c787a9576552a805ed0
SHA256

6718cdee3f26f0a2216c8a135d8666bfe3232d02a2792329e04834726bfa5e3f
SHA512

a6bb5a06b7502d53f05b0dbbc34dcd8d232d7e606fdaab3abbd839277ef6b01d8b71b6ffb5e7f352c0e30c5a64c6333f02aee796f207ae97e89cc47bd67c3047
SSDEEP

768:CgGzpDvpxWIQPVWt7mObRXlWXsHYJHtCTTOtMWhQSHN0TrR:fGFjp8IWLHtoTXWL0TrR

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2508	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2508	AcroRd32.exe
2508	AcroRd32.exe
2508	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fbf1752ad63a66e8c16536b443bbf7bc_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f7666b694bb1454b2558b4f473338ae4

SHA1
4f505328f61dcb03642182cee77dfee8d6eb5aab

SHA256
762f1b5b099c4ccebe784ddf2086ff0a26764be6efaa5a8015ab8adb03f53093

SHA512
2465b3900eedb7f1f685c643e90130e9ccc389dfbd9d2b50bb868c55ed7dff71e4faea46d3b8e2e3b602740765b19ccca445fad8438ebecd61918c927cbbc13e

Download Submit