baaf09d65a681dbbcd2be2e4e6d3d0dca1ce0bb064c20e48ba79e5c505ec2421

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 04:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

72a8282b5cd49b75a76beffc74ee2763_JaffaCakes118.pdf
Size

1KB
MD5

72a8282b5cd49b75a76beffc74ee2763
SHA1

ecbf6280855299d83c6b65084b035d2c3579121c
SHA256

baaf09d65a681dbbcd2be2e4e6d3d0dca1ce0bb064c20e48ba79e5c505ec2421
SHA512

7ccdea6412038c93740c3b1a5e6ee7bf78f67d7d4273ac5b9463962a3c94de00d14a18e60ba9d22aa1de2fe8ecc69f70afde059d3192017f580203562d5cd3e0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2276	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2276	AcroRd32.exe
2276	AcroRd32.exe
2276	AcroRd32.exe
2276	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\72a8282b5cd49b75a76beffc74ee2763_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7bb407a22dd68308a66eda17f62702bb

SHA1
74b6cd37faeff7ff13c44c0cc1d186a5870ff2bf

SHA256
ad5bbe912ae73a2200eb6dd9da5fda48ee5a6d8b8d164b33b45e992eb8adfd38

SHA512
958011dc75a22dc313893e59020b8912d72f9e558771e8a0562ac7bc8a21637390192c5e015efac4e800c9019f1c7fd11dadd77738c9ec91c84901d28c96fd0f

Download Submit