d3d4074410c56bef91e82d6c17b92830e31422756a9b40f146e0854538165281

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91c040bdac4103be152832c5ffa3a3e2_JaffaCakes118.pdf
Size

94KB
MD5

91c040bdac4103be152832c5ffa3a3e2
SHA1

3d182d3f717a1bb18e622a164be7ed969b522370
SHA256

d3d4074410c56bef91e82d6c17b92830e31422756a9b40f146e0854538165281
SHA512

79d96cd727966f969ed1e3e8663ea30d0fe22553382ca1d4c437198154e7e9aa62fd6c6c4f86c3cc02627e311fc1219422a9c0db4c99507c9751d5f7510b3253
SSDEEP

1536:fCIzDXPsugip9iz2Er86CWiCc0NzAug0/cc0TSyYjDtu5EzZsWHpOvTWUn/XutPi:fhziVI6C1P0x9/cPTSyjQZkvV/e2F1th

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

AcroRd32.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid	Process
1968	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid	Process
1968	AcroRd32.exe
1968	AcroRd32.exe
1968	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\91c040bdac4103be152832c5ffa3a3e2_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2d66d660b1208ec998ee59c0013c3eca

SHA1
06a6b97376d5986ce7349ceeb189b41ed42648e8

SHA256
0fb190ef757d7ac790d40751d425cbc9e8598b32cf5bd04df78ce29c4998e8df

SHA512
7e19c7dd7cbc0cc9b8e5c65428e99f7dc77b1760349210425c0f19b20cc09403cba0781dc8691e98fb675cc7f68be5b18c2736eaac7746f497a3e9d63ef36501

Download Submit