53b5e7b9500b5015d4da364d877033e622d3ade3dc8106e4062b3003dd89541f

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc6a0b472cc0e98eed61b446777c2922_JaffaCakes118.pdf
Size

78KB
MD5

fc6a0b472cc0e98eed61b446777c2922
SHA1

894e59206e564265bedc816bce2277f0e79b0724
SHA256

53b5e7b9500b5015d4da364d877033e622d3ade3dc8106e4062b3003dd89541f
SHA512

6af95d726b14b0a9b2677a4df145e811d8bd8c0e513aa44993e518479e9fcde769abbe9674db26e61d350a5c8d47f209ebd67ce6e59d18687b59420702bb07e0
SSDEEP

1536:O6McdgwJ5IKXIg0SCDVPd9sSWWR6UWGGDHDEd6ymWOpOwrbiE723oB:rnud5SCDVPd9sh/jybwrP7FB

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2904	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2904	AcroRd32.exe
2904	AcroRd32.exe
2904	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fc6a0b472cc0e98eed61b446777c2922_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e741533d2c52eaf2ca1a537116051754

SHA1
cb24c5d023b89055bf4201b5a539fa9ca329a573

SHA256
e247ef4e0831c21f9b0c369cd51b59eab9b2151b4819b4b36e5e86c32e446911

SHA512
9ce3402613b462adaedc4b8a7efec4dad826498e63c7ab9b6842b216f555b599a19d00720aff4c30091e4918138155420d856b352b49ebb7868948aec579d33d

Download Submit