a218cc87662f11dea5c6994eddb6edc9bd513a89040ce9d38bc1d6bd4b9cd927

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91efc8d94a308cb4cd1021aa689eec62_JaffaCakes118.pdf
Size

86KB
MD5

91efc8d94a308cb4cd1021aa689eec62
SHA1

f8a56146f385bd31475180638ac1af5669821a17
SHA256

a218cc87662f11dea5c6994eddb6edc9bd513a89040ce9d38bc1d6bd4b9cd927
SHA512

56b3f0514c670bb3aecf3c2432b7e7c20a21da65860f0c84786c2e3f4c286a49e49098230698d4c16029d2b28517d9110df146ce1c1bdc33b526511ba1a1044e
SSDEEP

1536:dQAyT4HI2AzVCkyGLWWmIMq7MLMq5V103FWOpOaZkDbWRWSkmmNfU2WcwJsL:nyTeI2ARClGoIB7MLri3+aZ8qdFmN82T

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2596 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2596 AcroRd32.exe
2596 AcroRd32.exe
2596 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2596	AcroRd32.exe

pid	process
2596	AcroRd32.exe
2596	AcroRd32.exe
2596	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\91efc8d94a308cb4cd1021aa689eec62_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d39e348dad617e0998f5b81111e4ca89

SHA1
c0dcfcfd96aa15a8e1b3728f3775d64e632554f2

SHA256
c9f873495fb2f3161cc6a6669650f4caf657edd00237dafeba21309ae0e2dd74

SHA512
13d0e0bdfb5befa1ffdc2a5e22e1a29cebbf919be0add0546d4d1ec648129cd9adb2a691d4ad25116f6c28b6059c03baa3e87003c495a139c68ad09aecf8abd6

Download Submit