05d4d9b8b0d37de74f2a4271c3c7c0b86f05f7727c97feda38762f893ae04a4a

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91f520c807f758b0373a4a4e1d9f5841_JaffaCakes118.pdf
Size

79KB
MD5

91f520c807f758b0373a4a4e1d9f5841
SHA1

3b78e6468bf0ecc54b7f939d43098e90882cd1be
SHA256

05d4d9b8b0d37de74f2a4271c3c7c0b86f05f7727c97feda38762f893ae04a4a
SHA512

48a2656266c9b5f5bb749b86bd7408aae7d799c3767e423708bdd5e75661015892997c3e94f42e85373ed311c86c90b02b2468d7cfd8f4fa16d28a4a2698bc99
SSDEEP

1536:x2N9O2zNAo6jMwXtdb/RFnBkOB+OZ6+E+5Ih9j1seWApO6eWn1aApA:spUwCpRBjB+OZxE+5c9Bsl6za/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2384	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2384	AcroRd32.exe
2384	AcroRd32.exe
2384	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\91f520c807f758b0373a4a4e1d9f5841_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
aa3e04db14d9180e05f0ce80303616cc

SHA1
f7cd2a178d8faf471f6f6f04d80d638c766b0ee8

SHA256
fbec9e89372bf8ba9faa552540088bd8ce8f4ebee1589247d20157ec1f70b096

SHA512
c6aa93bae6ec20a9ba2fd451743f496842ed95f39eb123b3ddfa42762dd7e6d35db60b963fd55881539e1edc97789fe0c6dece0edc00e51d3ed096fb489b6df6

Download Submit