974c38f8833834006b997cbc2ed2117a8776f4351e799724810d3458d3f3eac3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1b5dd8fa13e35a1dce09b843ef205db_JaffaCakes118.pdf
Size

1KB
MD5

a1b5dd8fa13e35a1dce09b843ef205db
SHA1

279b1ef9b3f339d61b34d47ae6167b1220e1c550
SHA256

974c38f8833834006b997cbc2ed2117a8776f4351e799724810d3458d3f3eac3
SHA512

d68227f0b3ff3bfa9d0a6ac0287f60f55608156c406dff8a4b184e2fdf12b876bcd94bf7b3aa6033411e09cedfe5fa864ebd4281dae407e30deb65af27a33595

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2548	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2548	AcroRd32.exe
2548	AcroRd32.exe
2548	AcroRd32.exe
2548	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a1b5dd8fa13e35a1dce09b843ef205db_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
97c846c26015cff98792a62396d28d0a

SHA1
437dc48703fd70f728cf58456d854ccfb3c395c8

SHA256
ef14350aff839ee867f4cf9fcac5d7d7f0888c22977683ecaf2ff41099ae313c

SHA512
84c56b0136e0e6eecfe0f553eeba306e663624f5780f2b8935c3487c31f317a02f43991b00dee77720682237e21836271b76d09f0d1c7370362e75e1cba1547c

Download Submit
memory/2548-0-0x0000000003000000-0x0000000003076000-memory.dmp

Filesize
472KB

Download