32e935ab0153def69912203c96221f475b49a4b6e9639b13a9c63fee053bd4da

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fd6e58d5224651294ed92003ec72009_JaffaCakes118.pdf
Size

77KB
MD5

6fd6e58d5224651294ed92003ec72009
SHA1

7b0af2541d5287e92da3b98c0cbd91dc9f98439e
SHA256

32e935ab0153def69912203c96221f475b49a4b6e9639b13a9c63fee053bd4da
SHA512

3cb16812d11f17f57c21a1a00e70aa77a9bccfb070777eb9c8b3294e2f4b4d123848c5bee8ee56c28bd79e2132dfce988cc55c2ba371750f89c1a0c20dfacc24
SSDEEP

1536:FcT0yLe9Ej5Xf+zJqitIhKKMvyWoW8qWniUcTMUWEgdQ4wTq0+OBM:ig6wEBGz4itIoKbLqWiUcYnEgK4Mq0y

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2624	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2624	AcroRd32.exe
2624	AcroRd32.exe
2624	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6fd6e58d5224651294ed92003ec72009_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3aeea8a4ad7d2a3cd592b5bb2891e79e

SHA1
65edc19ae716a896aa61f2d5c0a51fcca3275f51

SHA256
981ed77ba0efbc0c9059dcedc0377f4a420954ed8eed67e9d1652dc93eeb7266

SHA512
19875ccc89f8f809e542bf3123af86086d5c1ec620363e1ad6a0c6311e35620ebaab8232fd577942a0433a0da8b21cc67f8f1be1d9541e344ac72a04ed1519c9

Download Submit