aebc63f002b885beae3096404272b73d03b827b307df283831608cfe871a44b4

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75669cae1e947dc9a1559d557913e02c_JaffaCakes118.pdf
Size

87KB
MD5

75669cae1e947dc9a1559d557913e02c
SHA1

82ed8db1bb7b6335225c31a5838752d0a9716f9b
SHA256

aebc63f002b885beae3096404272b73d03b827b307df283831608cfe871a44b4
SHA512

cfc150bfdc204146553dda3725807db3ca875361ee11bc7232c59874dd9be28bfb571810c7fa3fce071cc26cfa720a1374dc9aea2966084df119722ffa32350f
SSDEEP

384:bONbedw+lJ5cO4YLo0SBRF53HJYab+6rOYYeDoK3p6VX8J1VwACy0xj0eQqsHrNE:X

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2552 AcroRd32.exe
2552 AcroRd32.exe
2552 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2552	AcroRd32.exe
2552	AcroRd32.exe
2552	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\75669cae1e947dc9a1559d557913e02c_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2552

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-0-0x0000000002FF0000-0x0000000003066000-memory.dmp

Filesize
472KB

Download