c351638df92582642df8674b69941847352b15b4045059adeb0a2fe2567f5135

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fca76a0ce2c16cb404f6ce40078a9845_JaffaCakes118.pdf
Size

43KB
MD5

fca76a0ce2c16cb404f6ce40078a9845
SHA1

2544a5e409022f9845dc1ad8a9f5c669db0b6641
SHA256

c351638df92582642df8674b69941847352b15b4045059adeb0a2fe2567f5135
SHA512

a5163e1a8f22daa7b7626716cf8f7cc0b1db684b44677571bbed01b32a0fd0280ba2c9eefc26e367a0a33e29da81ce04dca2833f530281eee659061122a1887c
SSDEEP

768:WgGzpDMRtPVasc9eGN7EDRveCbJyeJydRcbAxCfziBcO5TkUieVR:DGF4w9eGN7Ej9AdR5uziBcmieVR

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2668	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2668	AcroRd32.exe
2668	AcroRd32.exe
2668	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fca76a0ce2c16cb404f6ce40078a9845_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1236561aff1d08206d8dfa1a4a48cb48

SHA1
a1be7be42dcb19c828114eda7982901a332227c7

SHA256
101b609353936cc822a6dd0783a5ba524f559c4a468952497dbbeda7a4ec0543

SHA512
6f9067aa31dcd1075d41b6132ee6d5d52c0aaebe59834db41c4ea175c07dce51d27cf5ee9cc10024b5c436bc35e0b980cfb7ee75e09bc3770399b8a333f5cd20

Download Submit