3c62853734010213c711527aad4efb6b00c928e806098150503565838e8c3f04

Analysis

max time kernel
25s
max time network
38s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a324b4980aa2f6700e856dec0aa705de_JaffaCakes118.pdf
Size

101KB
MD5

a324b4980aa2f6700e856dec0aa705de
SHA1

c725b348f884256f37f154a9f3a9f3e76b338c50
SHA256

3c62853734010213c711527aad4efb6b00c928e806098150503565838e8c3f04
SHA512

7135abf076d65a12de58b68e5ace6979a1eba2946d85a4e666cbdd810b4a6f73f4972477e1fcf7ec31cf7cd88e41748c93d6cb8bdb1b8f2d36aa478666a7005a
SSDEEP

96:WEDsNyfV0aWJ5vFB+Oun/2M1FPxYkLKTpyauWUrWCa2pDXILR6CBqtZZPmPDx+:WysN0Au/26FPxYkOgaTCVpDXAM9NP4F+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2960	AcroRd32.exe
2960	AcroRd32.exe
2960	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a324b4980aa2f6700e856dec0aa705de_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2960-0-0x0000000003910000-0x0000000003986000-memory.dmp

Filesize
472KB

Download
memory/2960-3-0x0000000002120000-0x0000000002121000-memory.dmp

Filesize
4KB

Download