15fc5f3c299adcea8ab35d8a9b02346f1fcdb26a0b424dcda3808b1207f7b6a3

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd77204a030b4a407cb6c482abf2977c_JaffaCakes118.pdf
Size

35KB
MD5

fd77204a030b4a407cb6c482abf2977c
SHA1

934e4e2cd0982cb98fa5e0ed5a8d952232bc9b43
SHA256

15fc5f3c299adcea8ab35d8a9b02346f1fcdb26a0b424dcda3808b1207f7b6a3
SHA512

cd43a71b0af0f55422ffee3b0ad24910981098ab6986ff53046a23041b7ccaf4d114e0d8b86e73f6b88e4b911a8f858cd559f0f4e5ed48e2332286b2fabf7fe5
SSDEEP

768:Y/xX4kFaVfVrir16PiV+GSmouaDQ0a/FP1I3/gFVbkKtHE5RXuMZmwgCLWarJW:YzFsfVrir16PiV+GSmouaDQ0a/FP1blj

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2440	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2440	AcroRd32.exe
2440	AcroRd32.exe
2440	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fd77204a030b4a407cb6c482abf2977c_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f19c7541105a1a470387a3460a0226ee

SHA1
d3ef1dd3a0ec6a8859389ba7b0ffad3c26fc3c05

SHA256
314cfb7f54f3fc9814989f15a1c06cb80b4c9edafcbbbce94d0eccfb0ae8a8b3

SHA512
1ef49d166aadba08dcce81bfb772bdaec15b487e51bd27561cc14a3aa5fa6e397038311bdc25fcf2e6f728e1d01f42095b7f9ab3da6075e1f79c87d215a7a33d

Download Submit