268a5440e8b8b39e3439de7978c518ec5210374b8165ec61d94eff26bdaa6395

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da7fad4e23d67853d4bcc801545a7763_JaffaCakes118.pdf
Size

8KB
MD5

da7fad4e23d67853d4bcc801545a7763
SHA1

21540352e08a090120c4a03f9779b8e78ebddc06
SHA256

268a5440e8b8b39e3439de7978c518ec5210374b8165ec61d94eff26bdaa6395
SHA512

b3a094c7411d7e1e1e35c0b20983824507a7a15f6b7c3e9012a21b0972dfac741a4f414f89c3f322018ea33f1571b4f7215b9e0ba6f06197c874d6cdf4ce0236
SSDEEP

192:UP5uFm4kAKHFM66HGraNM+Unq65rjPm31UDvvG1ZdhtFIQN2gwSYX:UP5uFm4kPH+63aS1BG836ZztFIQMgwSo

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2076	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2076	AcroRd32.exe
2076	AcroRd32.exe
2076	AcroRd32.exe
2076	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\da7fad4e23d67853d4bcc801545a7763_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
891673f27b7375915c6bbe644387e47b

SHA1
e21d22fb0e87284e2d5fdc9edb564a0108e03ef7

SHA256
7f8b83a1bbf0fba7a9aa828de464f306958884a918cd7fe5083a44b5e06c82af

SHA512
ea9cccf1cb91ce2cfe4baec9aece4304f72b1fda0ccae5dcc8a5c95739f952cbd0b5f458071735c726ab18e6e942404fcbc1361b1a8214db4cad7cc4fd7f890d

Download Submit
memory/2076-0-0x00000000030B0000-0x0000000003126000-memory.dmp

Filesize
472KB

Download