dbf4cdcde57413dc11514f89cc8a9785611465f7e91c5eba6016278184b0c005

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91d747937263f08e413f61fa78194840_JaffaCakes118.pdf
Size

88KB
MD5

91d747937263f08e413f61fa78194840
SHA1

4bea6b68d85908fab1d09fca806ca3240d6cb42d
SHA256

dbf4cdcde57413dc11514f89cc8a9785611465f7e91c5eba6016278184b0c005
SHA512

1b3c1b4baf1589d80241bd62403eec388c84e8fe5c42b8b3422091d72ac6c8327e33339f096e9330c5ff674626ab68785e0083643fd1529f5764abcc4bb751b5
SSDEEP

1536:DRQnMl1o2St4CpnGfdmTKL3BjCjpM/2/EYtPjC8vWSpPWlvydDQ3UKhCWApO65b:V/o2U4CpcdmTaJCj2/2ZtbFWSp64KhZ8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2396	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2396	AcroRd32.exe
2396	AcroRd32.exe
2396	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\91d747937263f08e413f61fa78194840_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b0d1dd995bf4c0a87e3d43c7f0a1bbcd

SHA1
13da9f900fd4533595d824fc902d768f8f9700a8

SHA256
56d72a04a58c35adc14189f6372392a8ee627cd2c39a7574c938c4e5831e9b7a

SHA512
ff26198e9a2a440e201fb557cc86e0b1d185c8a315a221bd11eeb9c770750c8464023e0ff4367cf5236c176a20437ec4cfe52133996771c9a04c732bef4dd99a

Download Submit