58f3fcc3e9b80cb1185716436459d47d6c03b1ee6f0294dc265067451de4f24a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 22:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6928f655fb8ff0e17b5aa695046a7793_JaffaCakes118.pdf
Size

9KB
MD5

6928f655fb8ff0e17b5aa695046a7793
SHA1

1b433863fc2cb3eefc227c82ec1fa8acfb63b7bb
SHA256

58f3fcc3e9b80cb1185716436459d47d6c03b1ee6f0294dc265067451de4f24a
SHA512

46ac9220d3ac1241d9a974a2437ac5147c8781776e6873e7afe9f445a5568ba1066b0640eabcaa5c9117f6a0be50296c248be0c79d89b3efc89cea9ff29ae830
SSDEEP

192:mPz4ULMxLIKXHsfyxFFvd40Txtq3ynl5ktsj6bO/o9+LM5PPgbsvNqPo+kC6:mPz4ULMxLIKXHsfC/aIS3ylWsjKMJcP1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2876	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2876	AcroRd32.exe
2876	AcroRd32.exe
2876	AcroRd32.exe
2876	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6928f655fb8ff0e17b5aa695046a7793_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
32f2381b583d874b43a26e33929c953f

SHA1
1c9fbf3136872267b3aca255b58e492561480fcc

SHA256
3d45db25bdce07a03bc1217accee3f63cf1dcd8778107eb0c31e4b4673017e2c

SHA512
f6c14b9b2dae89b68dc6cd91cc181266a3a494a1c78dd005dc80253df9448c02e5fabfb94cf10e283fd95a6a8c5997739c57a73e91d138247f56a9d606ee0e81

Download Submit
memory/2876-0-0x0000000003270000-0x00000000032E6000-memory.dmp

Filesize
472KB

Download