86fb449456a9a691b4ca44fa2d4311ccd6e5b76ceb9f0d86eabb3bce67770ac7

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd09f7c614d221ae4af0d567276ebf8e_JaffaCakes118.pdf
Size

186KB
MD5

dd09f7c614d221ae4af0d567276ebf8e
SHA1

42f1ffa5f9323462e48cdf652614a8794a4b4716
SHA256

86fb449456a9a691b4ca44fa2d4311ccd6e5b76ceb9f0d86eabb3bce67770ac7
SHA512

19119b4e602a3f5ef5011ed93e96dc35d03fad10c538d5fc9198ee59ddb77a76dd23d11781fdeaee0bfe5ab670eb78b7244e6dce78a828d908b56813ca958b19
SSDEEP

3072:N2irbxzGAFYDMxud7fKg3dXVmbOn5u+6KjnyC8/oAuETdVCtESo:N2MKlWQ7Sg3d4bOnR8fusx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1820	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1820	AcroRd32.exe
1820	AcroRd32.exe
1820	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dd09f7c614d221ae4af0d567276ebf8e_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
dc8a3126fb71198be1e8a79760de87a7

SHA1
1fde048ea0867d504ef1e332149217cf8cd16cfc

SHA256
fa1ee7143143dc1ee00cf3df81fc76c13b5695cf0da048a3949fe705d32e8bbc

SHA512
92edb7762c52cf1546c0fea83e455bbe77e6803adc7d534b09a9160ce84d3202e8daebfc9e87b6266e9c3174d37a4bba28e228708d0f56577415bcede487472b

Download Submit