96b4cd614920f5f3dfd7f2dd3cedd89cee7444413c822d1de0ec90afc523df6c

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fc6518a211fff02b54031a5c34ab1156_JaffaCakes118.pdf
Size

46KB
MD5

fc6518a211fff02b54031a5c34ab1156
SHA1

7ccb168ad50051a47e8c8edb665063f68ba2c428
SHA256

96b4cd614920f5f3dfd7f2dd3cedd89cee7444413c822d1de0ec90afc523df6c
SHA512

be1b553c2a19a0718acb6dfe60e73ee87903535cef82123a6b4f05ce36fe85fafbe5353144d44c344d29336dff683820e26621af1532131461395f32cc2dcc3a
SSDEEP

768:Tppf+vw7IlFYIwoyvQ9SC2KEbltnV5bOev5W2ZPwp8IGho1lX1jkDNE5+XuMZmwo:1N+RlFYIwoyv8SClEbnXJ5WEPFVo1vko

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2112	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2112	AcroRd32.exe
2112	AcroRd32.exe
2112	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fc6518a211fff02b54031a5c34ab1156_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d1f350f2b5c04421bdc44f3cad4ef60b

SHA1
e9813abe0f285ddc125abf96b6c65a2262eb4d67

SHA256
5bec36ce1d744ba0162aafe9f0610f72b023ae37e0459b0224e7cbbf32a2e98a

SHA512
86eced0577da44f3ce97252d672dc5f4be1a1f33c116af438a90a46ec5095560b636943e4646b8ec8a1491ca1387da701fe00403418f4fab0e8382dda3b7042b

Download Submit