e2af8cc4b35ac18c68e9386144113855afd891de76d65d322b40b6e805c104e1

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78b335ab658486fd1c26a3fb62d7164c_JaffaCakes118.pdf
Size

14KB
MD5

78b335ab658486fd1c26a3fb62d7164c
SHA1

826c62ff9a5b57d56c89c7c4803a7de7478b3270
SHA256

e2af8cc4b35ac18c68e9386144113855afd891de76d65d322b40b6e805c104e1
SHA512

bbab46a3b3d44272b7fc0af526c8cdf44d4c0912e462438aaacbd691479dcaf3ce24f7b3c9fea49b82f9ccce37bd00f463519d6450287572570544c9663d4f14
SSDEEP

384:wP5uqkokFcEC7jDlJC/OtY6wXOTv3oWDGl4bT1HCw4DQrdz5zhYX:+8S7jDlJQB6UWDm4bZMUxzZ8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1060	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1060	AcroRd32.exe
1060	AcroRd32.exe
1060	AcroRd32.exe
1060	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\78b335ab658486fd1c26a3fb62d7164c_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6be7eb0f9c88182286311e53b242e267

SHA1
ec8bf39f48a75b6918fb45daf5c20f44dfa979fb

SHA256
22f448431ae19f3ba5e4a1d979610a4e338a70cb8903c2c840cb94283f6943d3

SHA512
68fbab26419b66d0c2346c4ea588b74d007be0e8deb239f5b43b8b804e0030178e1764db5c0f816da1fc4399a0f73d8d684aca2ceb33be1d87d1d93b9ff699a5

Download Submit
memory/1060-0-0x00000000032C0000-0x0000000003336000-memory.dmp

Filesize
472KB

Download