3abc186a5de21bf800ab7554fd92d6271d333f82add8ed4b6b072abca8a95133

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/10/2024, 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46757e640b40c7d182672032eb9738ba_JaffaCakes118.pdf
Size

74KB
MD5

46757e640b40c7d182672032eb9738ba
SHA1

fdb34d0d384e4ed3f011a10a38e1357f13a71f5d
SHA256

3abc186a5de21bf800ab7554fd92d6271d333f82add8ed4b6b072abca8a95133
SHA512

735d144e08ecc1a2530542961e1dbf6d96d1b78c69ad4ec9aea28cc7361188a98a7ed646fdd5c939a47fe6d0154603cd202b85dd9868de590705083ed31221af
SSDEEP

1536:ulpwXtsHNXO6yrPl1VT5Hv/msNqzjMfFdHr7AtcXgjaWVr0sbVqld88HH2WApO6c:GCXwNrybHv/mzw/HYWAgm4dJHH96c

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2856	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2856	AcroRd32.exe
2856	AcroRd32.exe
2856	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\46757e640b40c7d182672032eb9738ba_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
67624333ac0902dce782adee4f21ef3d

SHA1
07e639fab762439d6dbc3227a5c750d6e80ad94c

SHA256
e19fe5274c6d80be1fd7d5823212bd0cde795acabca5518086372cb3df7814a2

SHA512
8fb1351ee64315d6f5e92365eb9be9ac722d23be2fda02486df570e2cf47832651b6622e33d42441616edfd5e8238d199c0ee1b589a59fb8859395e5fd05fb33

Download Submit