2c397b7cfb5e97bd8a4cff86abbe615df5e4937a70c3c73c98a064ac9f64e3c6

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24/11/2024, 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91d81ed8bb0038e527461cef033e56c5_JaffaCakes118.pdf
Size

90KB
MD5

91d81ed8bb0038e527461cef033e56c5
SHA1

d4bf3cc8d616e41eb06400576da15ad6c9cc40af
SHA256

2c397b7cfb5e97bd8a4cff86abbe615df5e4937a70c3c73c98a064ac9f64e3c6
SHA512

6058d343a6ae1b21ee9fb2b5ef851eff71da798e8aa02e446a1ba5c832d612867ccbf27014f7224209e20c942f99a8bf971db71d867f7d0b1e5276f6e90c2557
SSDEEP

1536:DN6lLwsBGBRDvpxbB24Go8rUnhTPWi0ZvBhontWxApOGPW7lL/:J8ksBURDvpRtAI0ZvBhwK3GPwd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2644	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2644	AcroRd32.exe
2644	AcroRd32.exe
2644	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\91d81ed8bb0038e527461cef033e56c5_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1f26c588ac4663b6e03cbe54a5cccbe3

SHA1
07752c3a566c767a84fb1ab9854f2565e06e14f5

SHA256
b879491eb0b3fcefdecdace188fc300cdc6919487f5d72292239c1696b02d88a

SHA512
a43dbec1327462120a2a075616d84c91d4b4451f13caea1dc3bb0a62bea00fde6c005e4177a230beb215e931aa3b13d339b008d4b176f580fc4b049884e077a2

Download Submit