f64a1af9a7269d4c2bcff4b07e745dc68b3dfdab28330ed6b908b00d17776492

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72a53a560e3f19969bbf24a50d618bfb_JaffaCakes118.pdf
Size

64KB
MD5

72a53a560e3f19969bbf24a50d618bfb
SHA1

2d97ea10d7139c5c01bd248d8efb7965c8572a79
SHA256

f64a1af9a7269d4c2bcff4b07e745dc68b3dfdab28330ed6b908b00d17776492
SHA512

5c3a07de71635672b734354dc71a00baf0f35207875e81ac1497c262c3d43461cdf4eaaf53afa1c1c104b6d4dad34ce42b32f6a11d7842a939bfe86160cddcc1
SSDEEP

1536:Y3uFB6w5L6iowuh3PeazzUx4dTvl6p3JVbOe:cuqw5LJ9uh3RnUudvEHVX

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2572	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2572	AcroRd32.exe
2572	AcroRd32.exe
2572	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\72a53a560e3f19969bbf24a50d618bfb_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7fd53d6c322edced5e964afbe2771f98

SHA1
3d2eb450637609f95af891747ae7a5e452dd7408

SHA256
c690dd5caf8d349e867246c3cd849071a354b4cbdab3acd4d092eda39f72a7a6

SHA512
0eb7afae49408eee2a6ff53ddba56b40e5cdfa007908914a9e0fb859cd11d28acb4f156bae87b0429562595fd390d5691ab5d7ff9d8f69f661a2bd58bc09b458

Download Submit