90bf43b10eb41abd59e5f41fcb494f236364912b93bde34998e9e468169ee10b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f66a241981643fb7c91aca052baa8411_JaffaCakes118.pdf
Size

88KB
MD5

f66a241981643fb7c91aca052baa8411
SHA1

dc2beaa2c11036400e93d4cf64b194e3fa1fae0b
SHA256

90bf43b10eb41abd59e5f41fcb494f236364912b93bde34998e9e468169ee10b
SHA512

d149bc0c3c6fe20b10b2794fab7d1ff5905465666f14aab6d35b64c1d72d378a017176221c4e443f18d82970e29b9266564293c9c39511a5aab889befec28134
SSDEEP

1536:eqfNqs/4FgrrLEdFYMJXxjEDF0Hcw1FpUyy588XbKkX/IZd1YkWo2tzsXA6EK:xqsQiHQd+MJhjEh0H3Pqyy88L2ZPYkWq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2100	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2100	AcroRd32.exe
2100	AcroRd32.exe
2100	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f66a241981643fb7c91aca052baa8411_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2109358c4ba7ded2c8bb1a724bdd6dda

SHA1
a1e1cc790d0c2121a5f43b77cb729a0b3be0127f

SHA256
02a99782b52ed3e414a577da5b3c79bacd25a74497f1b6396165dd6f598f0eec

SHA512
f83548cb8f95a9e505a9054cf2510fc9f551717de461944134518436d2499ef234e18ac6232c855f5bc7c7f328081805f9de85bda6a3e51b9778ce67bbf84b75

Download Submit