264a1bf6219915d3da0bc924f234bd5c2238a68982d0e6da4d84e6f008b1e144

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-10-2024 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

264363153d595bfb6182c1f0aa55aeca_JaffaCakes118.pdf
Size

68KB
MD5

264363153d595bfb6182c1f0aa55aeca
SHA1

dcd21df460c517e3122f4b0e0c4bbb0d363f9bff
SHA256

264a1bf6219915d3da0bc924f234bd5c2238a68982d0e6da4d84e6f008b1e144
SHA512

971cdf405dba8da61e7cb249254ff8bf85f9a4d07759f1411123a24d0bdb15fc0ba0bf964fea0172ce97e6c170414d34263ce88c2240af794f958fb53e6455e2
SSDEEP

1536:bdL6vOP7QYm2QomYNXlLzG2BXyJL2EGtQBJgT7J4Z:pL6Y7q1orXln9XyJa3tQOFW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2184	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2184	AcroRd32.exe
2184	AcroRd32.exe
2184	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\264363153d595bfb6182c1f0aa55aeca_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cb260a65f74eef4bb073267b4de6243e

SHA1
91789286c972304455a05470cf41004c7975b28a

SHA256
7bceb6ac39f158d39f744c40fa5c17f747b77512f23e3524c68ad7b56a98a777

SHA512
7aae9514b74dec1449fc19b548fd026cfcf5e2c6aee512bd04379154204277f77f8500fc9eda45ddf25000c63cb461f6bbe420eb480c7d2ac3def2d2ffc40c51

Download Submit