7c35f802f0d9ea53e1b84117b5b5138c9d19a3de2c001ccb5c25abc2a13f6e62

Analysis

max time kernel
16s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a0573789654653e54cfecdac02011b8_JaffaCakes118.pdf
Size

106KB
MD5

6a0573789654653e54cfecdac02011b8
SHA1

d9e5225ccda31f2e4778138d2099db6597d446de
SHA256

7c35f802f0d9ea53e1b84117b5b5138c9d19a3de2c001ccb5c25abc2a13f6e62
SHA512

d4bec75c1b519c39abce8181c8864705acf87ace73e8a5aa254a065dd669a0e8ec344ede67cb46eb1b255eab6b225269c922f0e0c077978fc704b4bc227a2489
SSDEEP

384:bONbedw+lJ5rnBFcN2udBIkjE4X1x9xAs8dNQAk/6CQOuw3BtumtpuL2ZTHzLSfO:u

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1628	AcroRd32.exe
1628	AcroRd32.exe
1628	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6a0573789654653e54cfecdac02011b8_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-0-0x0000000003F30000-0x0000000003FA6000-memory.dmp

Filesize
472KB

Download