b85c5173f4d8ebe62ce9444e7977002e7064ece4bbe9aada5eda1957d940104f

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91d6d214c6fdeaebd4efafb4a42d9304_JaffaCakes118.pdf
Size

71KB
MD5

91d6d214c6fdeaebd4efafb4a42d9304
SHA1

901c9e9ac14f1f3b26c4ab9605fe405cc1a0d715
SHA256

b85c5173f4d8ebe62ce9444e7977002e7064ece4bbe9aada5eda1957d940104f
SHA512

6b3d080673790346f4a28b6a1c41051670cae509ff64a08347f6152aa2c8dc3613d43051a0bcb92c5348398badf44ed1063bdb5bd91a8b6cb2d94570acec824a
SSDEEP

1536:EU7Pz+n5HfCIMX7AqXP4gwXadksowB0sUljVLfWngVf+lgElCgY1Xne:D7PuHfh+8qX//oBsg1fCafjElC7A

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2320 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2320 AcroRd32.exe
2320 AcroRd32.exe
2320 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2320	AcroRd32.exe

pid	process
2320	AcroRd32.exe
2320	AcroRd32.exe
2320	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\91d6d214c6fdeaebd4efafb4a42d9304_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
648ba35e3efae0e24099158d5a65be54

SHA1
efaa77f6fe7293266971dc9ae437a1f2012c692a

SHA256
ba4602eaef7dd5a7500bd52e1fa27002cc0de3e92c07d17b17f891f7bed6eba9

SHA512
e7e12fbcee31d91a2bfec7bf47c875196ff25b3bdd5199daebce2449c4027a795615d205b44485955d97761753fcf08404e6439e8a79e40f26355eecf3e4af76

Download Submit