9f926abef99cdd9974b97374205b8fcc81448f8449f13c8f178e5817c23cbc7d

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91ed1d725e5ebf62bd6d8e04e198631a_JaffaCakes118.pdf
Size

92KB
MD5

91ed1d725e5ebf62bd6d8e04e198631a
SHA1

46321040c8e12914d69ff7452c984f6764e0c405
SHA256

9f926abef99cdd9974b97374205b8fcc81448f8449f13c8f178e5817c23cbc7d
SHA512

5f851f6061b4d77a36f11a93d7137bd928dfb989408487884a5f58cc831bd943a0bebac4dab5d1a98a44d3fa92f11f888ed947e7cc2965164239e341aa9ad7c0
SSDEEP

1536:DjwZfArs3FT+ErbUGQV0P6DCZMT4kDLQnuVDaA2ytWkDUtpH9ZWbpONVIFtpfcsd:4ZfAoBx/FzP6DCCk0g9bNVkd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2292	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2292	AcroRd32.exe
2292	AcroRd32.exe
2292	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\91ed1d725e5ebf62bd6d8e04e198631a_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ff44cdd30f5acf24d4cdf6e8872d7091

SHA1
3739e37882834b1aede7a4238632c5db4f147164

SHA256
624f01c0d06c13339da8f88a308940caa244250cc1af19e645e6e88977ddd0ad

SHA512
d0ed665dd81c90d0c446892302944c60f57f3ccfc28795f1537702471f731638d4e48f75fbc81924ecffcfd95285a4b663174a2b994fa2297655178cb7c35f08

Download Submit