d9d2140ebfcff1eddf9ea4b7cf671cd5c669b8a775ded08300d84f6f72c2953e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88fe7b5e67a0f3e1c89c27e8a7065050_JaffaCakes118.pdf
Size

1KB
MD5

88fe7b5e67a0f3e1c89c27e8a7065050
SHA1

585b0bc1a44b65e7fa84557b878f52b68afc5393
SHA256

d9d2140ebfcff1eddf9ea4b7cf671cd5c669b8a775ded08300d84f6f72c2953e
SHA512

e03c05b3a20bd54d88834ac25529e1e898d27ff167ce8810b5ff76e4a5064a924bbda945a31ec001cbb96df126fdae814f540e45149d8624cafd9e00058f8efa

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1976	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1976	AcroRd32.exe
1976	AcroRd32.exe
1976	AcroRd32.exe
1976	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\88fe7b5e67a0f3e1c89c27e8a7065050_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f772e2bc157e04a4d508eb7bffb6f065

SHA1
ca7e5bb76a44f4eb04e1fa3464352b0c83463402

SHA256
8e0866b2484fccfaec78bdf9e79e3e3429a15f3fe86c456511a9fb25bba15981

SHA512
2a471523150aa4d53361d8b114829ccfef6a054a6a04a10e51ac15b04c810a959e71287a450539c2668dc80d92a616c508b85c7df65e2356903c89d71e0ba0da

Download Submit
memory/1976-0-0x0000000002C70000-0x0000000002CE6000-memory.dmp

Filesize
472KB

Download