654c3d97f608fa9b04d002441f89a53d753dd665fee92b63b1df3f26ca6e58f8

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-08-2024 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2644f3d06e8e4a3c28a06fb2517cb06_JaffaCakes118.pdf
Size

7KB
MD5

c2644f3d06e8e4a3c28a06fb2517cb06
SHA1

5d4c460a9bf70a6e48230195c6ed95897506cc23
SHA256

654c3d97f608fa9b04d002441f89a53d753dd665fee92b63b1df3f26ca6e58f8
SHA512

ab356823b02a9d4620c7c1bbca39e02eb811c887655c9fdf356df4ffcf2507c262d1306680b34ad23dfaa4f51adb356b442af78974599668ad8caf430335bbaf
SSDEEP

192:wUz4ULMxL1KtZys9+oOSQmSWkF/+K98AW4UBPUhA9lx4eNpZrsG:wUz4ULMxL1KtZyw+oOSbAP8hhPUteNpV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2272	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c2644f3d06e8e4a3c28a06fb2517cb06_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2c6e0191f329736adce7b5cbae225227

SHA1
b3e7c38d487c7c547b6dd7221fd9b62ae7ca8438

SHA256
b629f2b5cf6ab908a3addec9b9eadbdaea520cdb5d5e886e432fd6bd99e41119

SHA512
57971cee58cd16609b229cbbf72d1747cce7111930af64abcd8b7055d01eb2edb103ca647856b9519476e053616b9b3188353cf1936d03657d1ebe3493bfa31c

Download Submit
memory/2272-0-0x00000000029F0000-0x0000000002A66000-memory.dmp

Filesize
472KB

Download