0ce03cfd528e13cf4f7f738b069f69b134d1c3692973b4561343a0bce5e7c453

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78abfabb7f9e40f0dd757bd878140c51_JaffaCakes118.pdf
Size

12KB
MD5

78abfabb7f9e40f0dd757bd878140c51
SHA1

61c8d2a06def590d1bd71c826a42ec0b9c23c995
SHA256

0ce03cfd528e13cf4f7f738b069f69b134d1c3692973b4561343a0bce5e7c453
SHA512

276ebee85864c090e672682e73a13b9855472e9fe195f2f41a3e60246dd2cd07688e488558f66467ae7cf4095fb86bdf6f8259e5bb30bd128ab6cbd83e5d2f55
SSDEEP

384:PPz4ULMxLIKXHwVTAzcL+nXAIexOlXt/WAOoMmBn0vwrhgGyynbm5s/tMQfkQE:Pb/uZXuMgaXmId+bRGyynbV/ez

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2984	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2984	AcroRd32.exe
2984	AcroRd32.exe
2984	AcroRd32.exe
2984	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\78abfabb7f9e40f0dd757bd878140c51_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
aa862cbe1486fdddc83c1f0f6f5b4cad

SHA1
a95006e405c5e1dde0748165b6d3411d6b99d8c5

SHA256
470b6753bcbb4ceb52e2a9e0d7b52a7d4eece2eaacf7f93fe9fabda655d3fc50

SHA512
5e199ee9c124eb9399f01610611f678acd714793a9cf225929b263285cecdbbae03b1944f726f5014a76378ebe11bd0df21a8acc423c38b532ad37ac2ea737ca

Download Submit
memory/2984-0-0x00000000034C0000-0x0000000003536000-memory.dmp

Filesize
472KB

Download