c2890203bb00fc59e7c3e25447f9cdb315317b7a8d30a3dbc590d54700b68bb7

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe164e2642a49b473bfc947dd1439744_JaffaCakes118.pdf
Size

38KB
MD5

fe164e2642a49b473bfc947dd1439744
SHA1

715c43b773244607d9b22c38b1ac52257828f381
SHA256

c2890203bb00fc59e7c3e25447f9cdb315317b7a8d30a3dbc590d54700b68bb7
SHA512

cde2fe052b1eab1756f74046e04177c5b3ccd890eb0971b8ad8e29ff0b2d055185841f5c4f3812fef28d594ef3bfc289133dece6d0828d29aa62ded03a2bbbb3
SSDEEP

768:s5huksfwiXaG9amCNlzgQ+UxDT1IJqEPVfnOrVTn/slJlUI3hr9zBRqXNPbHkyyo:ehmfXF9aXl8jUp1IJqEPVfWVTn/slJlW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1852	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1852	AcroRd32.exe
1852	AcroRd32.exe
1852	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fe164e2642a49b473bfc947dd1439744_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3ce56592c7e5ffd2a7ab0abc2818bf98

SHA1
ad1643261a74b408f69baa009fea98bb00db4acf

SHA256
a953b710115bab31338f614869a21e83b12ad56aa37b8788ed4e7d5db40e7a8e

SHA512
a99cb91b78321ac07a8135aaf4a2206f9aea489a28b785a05264960fcf21cfd696b8075eaa1ce5e436267d91dded3969047ccc3c1dec61415c52872b89976543

Download Submit