c1b7f8ab330f1e8e392f7e95eb281f1dffa4a4b414f3c7b3f71d260ab830ba01

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91fb774eb3563f9b0ff72e3a9ccd145d_JaffaCakes118.pdf
Size

100KB
MD5

91fb774eb3563f9b0ff72e3a9ccd145d
SHA1

d52020d343d65f5c39ec1c09c4b7017881e32e34
SHA256

c1b7f8ab330f1e8e392f7e95eb281f1dffa4a4b414f3c7b3f71d260ab830ba01
SHA512

64bafecb2ee81ae5b043bdb335d3dd3f85aaefddd9a0191c630f3592b30810bfeb81655428d08e85937e1aa72457f285e3deabf3a9256e1ef2f5f4fc8e04dc84
SSDEEP

3072:8zakOcjLSg0oBmMf46xkDtiMwUGhepJxF/Z:8dH/jcMetPj5T

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

AcroRd32.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid	Process
2644	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid	Process
2644	AcroRd32.exe
2644	AcroRd32.exe
2644	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\91fb774eb3563f9b0ff72e3a9ccd145d_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
07fd4132d6ecab82a6966998ebad5e51

SHA1
f1dcdef4cc23e82e6654075ab50b39e0516f772e

SHA256
c39c65a23f78527cf96dd209667e4054e1eb98e6aff68660abf7ee463eb4d73f

SHA512
94bec905d81db1d1665ebdc5ee734ca0c0ac9a47234123e99ef37f2cee823c89195c5c49f054c9dd96bacbe4d3b2b36fe14301a2bfaba5af5002badc1e413d0b

Download Submit