591e92aae807ede201fd51c1230ced5a1919180abe431087984251915487e9a2

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91d249744fa19da5194d9a602ceb549d_JaffaCakes118.pdf
Size

46KB
MD5

91d249744fa19da5194d9a602ceb549d
SHA1

e958b37a78db0872987468f24c23779cd7e429e3
SHA256

591e92aae807ede201fd51c1230ced5a1919180abe431087984251915487e9a2
SHA512

4b3c8bb851f481b7db810fa028c11c1653cc69d853930615b9df252163df6fe08c0d61445e3457ac1f5d8a5ae27bf8fba20a0504dcd42ebda1a393a6a67503f0
SSDEEP

768:FhwU3csmhE1E66EkZ5nzqnwrCuCX58lAnPlTtBBzauc4g2Vtl0SoDW5nSp:vRsRhy+bZ5OUCuCXyqPlRBBGV4lVt0CO

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2368	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2368	AcroRd32.exe
2368	AcroRd32.exe
2368	AcroRd32.exe
2368	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\91d249744fa19da5194d9a602ceb549d_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b8c6c651528addc9f22786c9d85413cd

SHA1
b2a32d1353f78d879dab3a0e211c3fee6b60f437

SHA256
f5460c9c061ec664858e35375c2cc0133289d5ca5bf3b5c342ae37a1bb76496a

SHA512
6cc3b979cab193d6aedc8f5435c7e0d896cc6b4c74eefd0f8560375c645c6039450b57350db2fe22e9e8e5c589879add91d472c88004ba0ed614d90e96f1e407

Download Submit