c22479ab58bf22750ed86682ad1c3fd42c63805f6d344d863596374547f6707b

Analysis

max time kernel
93s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f70ce16bfa58ee2165e0a5af0b8fcb4_JaffaCakes118.pdf
Size

8KB
MD5

6f70ce16bfa58ee2165e0a5af0b8fcb4
SHA1

2731b968fd20b1a26f2bd27214f4522589e0da0c
SHA256

c22479ab58bf22750ed86682ad1c3fd42c63805f6d344d863596374547f6707b
SHA512

957061f181ebe633216271672a827d76842b3b4d92a9446ee9c3ba08dbe40008ce3dc9e55a46b18263a85c5d0fa4867b68a5d3e7657b2f2d55931fba4af346cd
SSDEEP

192:XP5uFm4kFMu1YV7huDLf5VIs+yBTXijRUDaY99zt7ubldY2:XP5uFm4kFMfwDLcs5TS9YD9zt78HY2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
688	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
688	AcroRd32.exe
688	AcroRd32.exe
688	AcroRd32.exe
688	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6f70ce16bfa58ee2165e0a5af0b8fcb4_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a091b1fdae699ce194e5a0c74541b3c7

SHA1
0d275f7b9bf7cd39daa33851800e30a71e9386d6

SHA256
2ab3768aa61f68e251064eaeed98efc35abebc8f242df95477feade8399e16a0

SHA512
15b08632958217cef8cd619862a926c0b7a01030e91e25b6324dfaec734d08360bbd09f1d2b44c5c77902b3d79725a2d800d709ccd844b0295393460954e6afb

Download Submit
memory/688-0-0x0000000002CC0000-0x0000000002D36000-memory.dmp

Filesize
472KB

Download