87d0808af2370f9d2accd503ed331fb0eff8291e6ca38905763991107ed4e465

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce34a15d8045d2bfbfaf27b0201e8b86_JaffaCakes118.pdf
Size

11KB
MD5

ce34a15d8045d2bfbfaf27b0201e8b86
SHA1

df2f195533306f04905151398d857fec4cb81158
SHA256

87d0808af2370f9d2accd503ed331fb0eff8291e6ca38905763991107ed4e465
SHA512

ff1509701a9e5368dde0f59430a8fc3b8b553741e81f047ec677521f097a1370c0315ea079ec82128d5a25ae330ed30709690159fd465120dc70ece9b86b6a39
SSDEEP

192:SjPz4ULMxLIKXHw086JyXcC6aaM+mFgzO45UK3hSamDnoZ8x7V2JHF2UB9xRy/XS:oPz4ULMxLIKXHw086JexlWKxamDiBxFL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2540	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2540	AcroRd32.exe
2540	AcroRd32.exe
2540	AcroRd32.exe
2540	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ce34a15d8045d2bfbfaf27b0201e8b86_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e8f9afb58171baa3edaa19d8a8ff1695

SHA1
6d113aafbf091d7d0b365a4772d2388df50134c8

SHA256
1f9111fcbb69ef176321ac1e67476a545807a514da0f2e272e7042377bfa66d8

SHA512
7befdbca0355592280701931bfd9bdfc3bbc3afe83dd1b2f2020ec3abe121f8aeaff03abe40b9f8424eb21537ad842b707d1f39c09924face8e9ba5fcb934565

Download Submit
memory/2540-0-0x0000000003550000-0x00000000035C6000-memory.dmp

Filesize
472KB

Download