46bbd110935e81bd20ed3d8acaac651dfa54095da313dcef57a536a456c38dd5

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd66a3e99b4be1e14b7f5acc982f75aa_JaffaCakes118.pdf
Size

98KB
MD5

dd66a3e99b4be1e14b7f5acc982f75aa
SHA1

6143df8192f83fdb2e60d467b318606aecacffa6
SHA256

46bbd110935e81bd20ed3d8acaac651dfa54095da313dcef57a536a456c38dd5
SHA512

49325912185b566923a43c5ffc59a932fd4a64a19f64e31f63fc2b75b460911ffcdd6d81af5874bf89a5f5b64228ccd42c73158a56f36df0e5f99b7394eeb67b
SSDEEP

3072:wQ/UPDB409zqTYU64UC3MpZR7GYD2Csv4Bv:zUPDO6zUzUcMpGa

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2692	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2692	AcroRd32.exe
2692	AcroRd32.exe
2692	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dd66a3e99b4be1e14b7f5acc982f75aa_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
031005f6541c75911dc9d4804dd05323

SHA1
1f7821b566ac2cc3a55d1791da05d249bbb4c09b

SHA256
44c6e064158d200b4447059506d913b9a0c25bea87355de8f5047bd0aa0dc7c3

SHA512
ab81be9ea9edca295ec33ca7f144fa96b948dbe2094dd29cd1a910929d56bcc503fad100a21931b937d1f4f8158fb596a27dca5dd53f32120c42d28a268aa8a9

Download Submit