64a87c1ddbf43e0ba32cea990ace86b4f7e1e69d484d2a62e8383e65d9a8f976

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a810e9cd76aa8d5f766a47d6e3275963_JaffaCakes118.pdf
Size

45KB
MD5

a810e9cd76aa8d5f766a47d6e3275963
SHA1

b0f9cbd97411b03214e39743a9ca302ebb4b7b44
SHA256

64a87c1ddbf43e0ba32cea990ace86b4f7e1e69d484d2a62e8383e65d9a8f976
SHA512

636c5e2ce125d65cb5713506f88f253337d98073f0b66458b718a2786c4b611c087862be596513c12afc8a6a83fe2a02421a714745a8545f46564ab83edc1a3f
SSDEEP

768:mWflZYWFq/g5UsQcg9qZR0Zxej5kyjEy3mpwPV+vmhJw/VHOcQ:mWd3FZ9ZRYwcyWpC4vYJw/VTQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1916	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1916	AcroRd32.exe
1916	AcroRd32.exe
1916	AcroRd32.exe
1916	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a810e9cd76aa8d5f766a47d6e3275963_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6b94db4521a911c160e6c6126e53d221

SHA1
c486f93b3d75dc9510cbba2372e79d5db2faab8f

SHA256
c47668312baabee152bee1f2d33f8e8cc94e539a2252adeebf8bdc46ac4887ec

SHA512
2d6215ff1ad149d81f567127015d22dbd918c450f44bc0413805be8f2911785f95e5f277d8a28de453da56301a74ef7733f42e92381f9c4f90ffcdab17d9ef67

Download Submit