30ed6f22740501fb1a48750842c9dc60a0db0f654aaab4712620c479e51517b6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-11-2024 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84de66cf1fda9e1df06f262dd4b1d111_JaffaCakes118.pdf
Size

91KB
MD5

84de66cf1fda9e1df06f262dd4b1d111
SHA1

cfcf2d3b13ec2e4e11c091685ce311162052d416
SHA256

30ed6f22740501fb1a48750842c9dc60a0db0f654aaab4712620c479e51517b6
SHA512

b2d3bf2c8e899258a0ba9194e4d0f972c83c39078e13b9f0b02a2cfcb9685c7cea87c0118be59f3b522fa4a70f4e4823d31a484205fb534ff89a61f89914a6ac
SSDEEP

1536:HSDSqWNwiv4ka/s3M63k5li/POhpbMfLgzEvF2WCSBXyBL8Ay8MzWlxllPpSbQ2:yhuvpa/wMsk5o/Pube8WF2WCSpyvyTIC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2696 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2696 AcroRd32.exe
2696 AcroRd32.exe
2696 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2696	AcroRd32.exe

pid	process
2696	AcroRd32.exe
2696	AcroRd32.exe
2696	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\84de66cf1fda9e1df06f262dd4b1d111_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ee33bea9a2424eb9fb8c33202f98ef77

SHA1
e04b4d756705f9427e08cd279e1d9c93156fea75

SHA256
5fcb0003e748c5e27269fafbecd244338444e739a1ed87e220e5f81b8de55c08

SHA512
02ce67a86b6401fa714a6384ebb08cef763bfce4a45933cfdb4cd0f42e50e424bccb176b60d044ff9fbcc09aa896ecc68b550ca28720d41738699dd7bfacc215

Download Submit