893335229f5d2da06cbfa3fa2b9c0c64af9355a958bcc7159543a0f1c3a52f82

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91c7dd8864f3b95d9c339a1dc1e47515_JaffaCakes118.pdf
Size

76KB
MD5

91c7dd8864f3b95d9c339a1dc1e47515
SHA1

421a0153d45c1757b573a4c04e7f380e2cb20898
SHA256

893335229f5d2da06cbfa3fa2b9c0c64af9355a958bcc7159543a0f1c3a52f82
SHA512

05b27b025517f258d0eded0820e3dfb6219d0c147f6280850d7498b75581eddf97bb867a5c1d56366030d4eb805383e4c14d5533ed15bf98fb1f46040e462d83
SSDEEP

1536:eHzq+gdQnyPOSjDf1May5RDfBup/bfjR+ykgd3dAaWmpOpNWfxwY3evowu8GWYVg:AzhyWSHNAnD5/vgldA/pTVu8XEKd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2236 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2236 AcroRd32.exe
2236 AcroRd32.exe
2236 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2236	AcroRd32.exe

pid	process
2236	AcroRd32.exe
2236	AcroRd32.exe
2236	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\91c7dd8864f3b95d9c339a1dc1e47515_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a55fad612d4c1a26d4dd57593d99e0b9

SHA1
f646f620c8d3acf906ba776de5ca24861b13d665

SHA256
065d1866ab1c3aed70badcd5b9443894a3dd533cc1a73d8d8d14191076af4186

SHA512
a7a9b9f80f076a936d2582c498e3edf2a58259bb33066cfd0403dac7c5f034c4006ea1c9b7b3bc0072e04596e7dbec3cf896d074f7a133e559a8713cf0b717b2

Download Submit