ae91974658203e560fe741c92006480b7d37ca9a7419f906e5ccbecfc3f62344

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91c1caa995a45b0231c0c06a93a9d720_JaffaCakes118.pdf
Size

92KB
MD5

91c1caa995a45b0231c0c06a93a9d720
SHA1

8085e5151284ab8b24b24af954a782354376e32b
SHA256

ae91974658203e560fe741c92006480b7d37ca9a7419f906e5ccbecfc3f62344
SHA512

00c08e782609afbe9a81ad85e18594e9dbe8152e69ef288a479ac3ced51ab2f25a1e5f0a18240507272894a54dface28e9297320247107b473430a0db227b53e
SSDEEP

1536:01cD6dhz40S+S6pRSzVhcvqA/IfYTlAYhIyRW3/0QCra1PamtVtW8pOGkIu68IWC:icDqhz40S+JSxhg5IgTlLhIyRWP0RWZ9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1760	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1760	AcroRd32.exe
1760	AcroRd32.exe
1760	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\91c1caa995a45b0231c0c06a93a9d720_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
73d99a49cfccc94ce2fb6756bdccae7e

SHA1
031b7a573b7d9512ff94f10b8193774a0e16b19f

SHA256
60e4b2827adea9b429e0a94155fa5d119e199a32a8e3d00c5f756f4c7b372792

SHA512
5964c8a9414523fc5f457ed0b825766c17b963d601033255e2a12e78aa63cd8c93921d9b9bd8e020eca5b3544702541ec7595a211cbd1a5fd6a1fa3820498e6b

Download Submit