a9faf68e5d4ee8587874a71767f7aadd8c6bc9222355c81269983f6dac9065cb

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91e368f2f2335481c38efca04d261e6b_JaffaCakes118.pdf
Size

76KB
MD5

91e368f2f2335481c38efca04d261e6b
SHA1

3aca9185d99658f4cc2e5b82cdc6b12d6e76ed1f
SHA256

a9faf68e5d4ee8587874a71767f7aadd8c6bc9222355c81269983f6dac9065cb
SHA512

4eb03ce50ad3a622249890ac003190da550eb6181ff07eb198c8224e4e27d5809c3f3e0b58cf1e5a71a9ed4ddf6496566272cefe1dd44abd7e830b902cd9f7d3
SSDEEP

1536:/CIa9fcfGkh4E5Z00EVlKGP+V9l1mrQ51QXbvBWrfhlg6W8pO7Qlo:c9cukh4AW0EMl1JULefhlgB7/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2400 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2400 AcroRd32.exe
2400 AcroRd32.exe
2400 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2400	AcroRd32.exe

pid	process
2400	AcroRd32.exe
2400	AcroRd32.exe
2400	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\91e368f2f2335481c38efca04d261e6b_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
54dc2b58c46ce633ff7adc5a64437de7

SHA1
272dd902ac50d18d66cb0817920d37543e81e7af

SHA256
810aad74928701c5edc935f676d65330789a5e4550d7d4801cb9950bbedfc3fd

SHA512
e20bde98b3cdcdf9e4df6b43c40019705e87e3551c0cd50d60ab021d5666893fadba7e084e39c2791e2e1ac440601e3460b9a17558e2548fba24eb36713d9731

Download Submit