7a34982c214a46499dd35bf6ed0576482ea9f94e379c6635e0a668add67ab1a2

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be91c6167b05f1fc47b22ce7cf61d593_JaffaCakes118.pdf
Size

11KB
MD5

be91c6167b05f1fc47b22ce7cf61d593
SHA1

990a8d868dc5fa243f63f09eb2c3c1f1e8b154ee
SHA256

7a34982c214a46499dd35bf6ed0576482ea9f94e379c6635e0a668add67ab1a2
SHA512

62788a266426dc4f3fe48be5872f987577ef7fdd0fcb03c3b7a4c8bfeb7a197f51a1d8163f0ce636fa020cea1bce527466adb7e62ed267723af0e446bbf3942b
SSDEEP

192:bONbedw+lJ5ES3YREAxCx2GJedTfTI0VFZedEP+zOQBt2Hf+P9sGq3:bONbedw+lJ5ECYREA4x2GJedTf8UFv/3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2332	AcroRd32.exe
2332	AcroRd32.exe
2332	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\be91c6167b05f1fc47b22ce7cf61d593_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-0-0x0000000002AF0000-0x0000000002B66000-memory.dmp

Filesize
472KB

Download