79200a75afe5dad20f988859bee1cbbd5e0b1afd801eb478097019814e367e82

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe8ad81bf3a52a637fe0b85e65376ab3_JaffaCakes118.pdf
Size

87KB
MD5

fe8ad81bf3a52a637fe0b85e65376ab3
SHA1

c4c049dc8562e916d9fd25eecf009fc64bf97a05
SHA256

79200a75afe5dad20f988859bee1cbbd5e0b1afd801eb478097019814e367e82
SHA512

71dc4aa7c4ab1fbff8371e2f6188c6e58eecdae0f38daee1250931c6ca2f2f33e384d2c7dbfdc9cd6c55d9673e99f3df45669ca712ea9b243b884921177a7ecf
SSDEEP

1536:WW8S0epR0IspO5o9bA+aTfjYhvqKYVhAw/IBDZ9dlfWoD+xQMH:1We6Co9NabjYhSVVG9pBD+x/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1868	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1868	AcroRd32.exe
1868	AcroRd32.exe
1868	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fe8ad81bf3a52a637fe0b85e65376ab3_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
dc13408ed8eb6a9a999adaf5c702e696

SHA1
0bde53ef5357798d09ba133fbcbc5327f0d57539

SHA256
07c09bb7bbca2aaab27692c73fb5615257ec2f5f0862f25958478db167a3e40a

SHA512
fae15127f2041b5615561af5dd6458173d1900426fe8e82f0e5b1813e7362acb5fb65e5363b0469d6ad3a98c1def0dd7dee6f997d95a8ef658f138a63bb9d9da

Download Submit