e5909046199f3b5e69ecf6b46fc68287c2aa18977a8fdc44bdb621bf4e058aff

Analysis

max time kernel
91s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

727f1724040a6700bc6e164d42124f3b_JaffaCakes118.pdf
Size

9KB
MD5

727f1724040a6700bc6e164d42124f3b
SHA1

0b6cd9413ef0b35418759844cc3e4c45df05862a
SHA256

e5909046199f3b5e69ecf6b46fc68287c2aa18977a8fdc44bdb621bf4e058aff
SHA512

b36aee46b3a06a509168c49f92480a97ccd7c4300e57be0f71ef73fa123b79200ac1dd0987e442444800c46ef24bd4996d4fa758668e450236d46920ebba4a42
SSDEEP

192:1Pz4ULMxLIKXHsfyx3rGLMn43GnGTd9TNQAuHhPj3un50QWg0aryxP77x7YX3ssV:1Pz4ULMxLIKXHsfC3rGL442n+9TmRbQV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1080	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1080	AcroRd32.exe
1080	AcroRd32.exe
1080	AcroRd32.exe
1080	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\727f1724040a6700bc6e164d42124f3b_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5d3676e6db6a307a397de8fbf5b6f341

SHA1
7403081a591450536c88baea368d5082df364d28

SHA256
c0ed3197fd204f3fa4dd8b313fa39223f985af7ba7d321189b357f511ba97114

SHA512
e5958c68798ae6c63fb8b20add658d702cbf4a3b71e83a4e45a4a72e9bbfca0ae8480d2002858ac9b468f889ababc1d8846c8d652673b51f0a2ffdfe444687ce

Download Submit
memory/1080-0-0x0000000003230000-0x00000000032A6000-memory.dmp

Filesize
472KB

Download