136ff339f77fb40da6fe427325a9dc26f3e7d1d44a23b9b95a57ab061423999e

Analysis

max time kernel
95s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9c2a0416e6f682db7e6b9058f6ecfaf_JaffaCakes118.pdf
Size

41KB
MD5

d9c2a0416e6f682db7e6b9058f6ecfaf
SHA1

30008b7024af9dd7893b3ca691bbebfbbc5a117c
SHA256

136ff339f77fb40da6fe427325a9dc26f3e7d1d44a23b9b95a57ab061423999e
SHA512

42a912f83ed84c369fac7734b2825463ee0602d302f37f3d576e2e5e4163db8c73d6547aa9512587d7c251a526e45c3ebdf8a2f3c59f9cfe26a897b579bea299
SSDEEP

768:vgGzpDKVWWTvX7HC3hPtlU4ngncZxcGkEvBg+cHMnxaarWFNxQarjkrMhq:YGFth9fHkEp/nxaarCNfrYrMhq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3048	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3048	AcroRd32.exe
3048	AcroRd32.exe
3048	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d9c2a0416e6f682db7e6b9058f6ecfaf_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
82dcf3e06ccce2af2c2056121babc8bd

SHA1
8772ccd3f516afbd2b2028d3b8d6ae572d24ac37

SHA256
105b48c07cbd71866e69d9f4a4187b0f9d5988b5186b19014761d9bd91443077

SHA512
b5ed53f7afe314d2ec99bc04982ef3836a773e98d624ec7765a7819d67cef7a83f6ff50b5a2f49815f60cd9a85f88bbeac5516d44fcc1e06a77e45e89b9919a5

Download Submit