108855730908af6d2cb064ccb206d5ee5a5252662d257d64e777d7a2ba059fe7

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91c356c9e7003cb02cfeda73309ce150_JaffaCakes118.pdf
Size

76KB
MD5

91c356c9e7003cb02cfeda73309ce150
SHA1

02be075b64d249130a43f0863b55031a76d92235
SHA256

108855730908af6d2cb064ccb206d5ee5a5252662d257d64e777d7a2ba059fe7
SHA512

9e7ddf0d2e0b8dfcd6c7fc207acd5324846ae8576e73abbcdba36006b60941fef06637d4435c677abd9882e99a9338af53849ee1db9ee28a2343bb41cb919850
SSDEEP

1536:jWbAeIibGeo+8tY+StJswcVZIXMZrWPWP0wDasfW0NWApO6/Da:sHpqcuGXMuWPhasfW0E6+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2468	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2468	AcroRd32.exe
2468	AcroRd32.exe
2468	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\91c356c9e7003cb02cfeda73309ce150_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
91f995a5bb70ff3fdcd73deb9be1a124

SHA1
e185252f2412948c97a3de0cba300ed3268be87d

SHA256
d76c1ea3a73a7587fe73022c261c55fa1f2b1c772a7bff9ecdd67fd4788f95f3

SHA512
e3a5a2a5dff7a1e2a178fe633089c1c25732ec7206732f4fddc3d9f9075f556e3de3ab4b711e1bebcee32238bc576133381ff062389f1d629faa4d580e5093a4

Download Submit