5c7b7aa19bc9f6711eb50d0d5b29c1ae1860af93f3e932b1a1bbf8de14ed2bec

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c177a31015005459ffd6786f2506b463_JaffaCakes118.pdf
Size

9KB
MD5

c177a31015005459ffd6786f2506b463
SHA1

e87bfc213a9bf2de2f413ac1f3984162e96337e3
SHA256

5c7b7aa19bc9f6711eb50d0d5b29c1ae1860af93f3e932b1a1bbf8de14ed2bec
SHA512

743e541a5bf9b26691b2c5e7536cacc774a99b3001b2f57ca670a3ef69e207fe959029de72fd0cadffab92ac957c7c4e99a1644219615dabd460f9742bfb48d1
SSDEEP

192:FPz4ULMxLIKXHsfyxqs6w3YEMzsziM3YOqfUFUxrQLfqBtRnORgWmvUaEBmQSpXq:FPz4ULMxLIKXHsfCqBwtMz4imdqIUxrq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2072	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2072	AcroRd32.exe
2072	AcroRd32.exe
2072	AcroRd32.exe
2072	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c177a31015005459ffd6786f2506b463_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
93078ac2dcb51e5d8627a2bf567fc9e8

SHA1
acfb6ef47d26c26e3fdac5035a315e28b929697e

SHA256
d77c21ec8009d161cda76d3030b799be462c854282943f10f3d9fe2b0aed805a

SHA512
9ab3d89ac09cb2dda5192fb07ac8a6e82019d20f81fae2cef7a4612bc41cd343654dcb3a8f0a418f46a58cf65f56132d86d71288ff161a41e998c167dbfa0fd2

Download Submit
memory/2072-0-0x00000000034B0000-0x0000000003526000-memory.dmp

Filesize
472KB

Download