3791e3ee90313cb0f579b2835cd811a1db428291d5fda191c818d6f903acfd72

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4f094fdfa8621f5e59f439a3d93f8dc_JaffaCakes118.pdf
Size

86KB
MD5

b4f094fdfa8621f5e59f439a3d93f8dc
SHA1

683ee9de8f19faec6e0872d90a823607dfe4c76c
SHA256

3791e3ee90313cb0f579b2835cd811a1db428291d5fda191c818d6f903acfd72
SHA512

cb503fea7cbca57cc2d287e846271cb97d9fde9d37d5873dabebf8b449b9d0d6afe2d8559f9c1cf0bd605c48776873e6ffa145ba948e2355e1b364fd0b960aa7
SSDEEP

1536:2EtrNKVR1rp42qPb+TXAa0flHVBKY/vWypOlLWHBqW7QRFzlE02t:trc7p42qP6TT0flHtYlLIh2FzlO

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3020	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3020	AcroRd32.exe
3020	AcroRd32.exe
3020	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b4f094fdfa8621f5e59f439a3d93f8dc_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8fa66c4a87dc8defc38aaa2755bfc68f

SHA1
800028673d55ed1dbd9bfef36739f5604f319ba3

SHA256
acb49f4e5766c54c090ae8cc63f08328c4d245afda5df4dcafff3da8c6f977c1

SHA512
488e541c4add5eca43b9f9e1b2cd29d1aa607125d3d192dca7bd239a8495cb7d53a73a87c873203971de944c4bcbc4c94d34dd0ae0213ec1fee68ddaa3681d4a

Download Submit