f36d6f7280c2a28ce68bd1fe3e7ec37639f01253ba7c5b7e61f1ec7e1549008e

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25a696e3e7152fa43f9828ac2da32727_JaffaCakes118.pdf
Size

42KB
MD5

25a696e3e7152fa43f9828ac2da32727
SHA1

51bf77b6154c73cbf63b29961a789277358220c3
SHA256

f36d6f7280c2a28ce68bd1fe3e7ec37639f01253ba7c5b7e61f1ec7e1549008e
SHA512

b032ce15445371083b72a4c5c989c19b6b6c4df6a99ebb9d6d14d18caef01599e9cc05f160ca90dbad424267d1fc049538d25c7d1c7de2253d03a00f32725c7a
SSDEEP

768:mwWs6UeAH+iDtr9/lk301SMVPZcFMVLmCmjPFtV/9IwfZK4LN54n:zWs6UnpDtr9/ndPZcSVLmCiPTMQUn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1872	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1872	AcroRd32.exe
1872	AcroRd32.exe
1872	AcroRd32.exe
1872	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\25a696e3e7152fa43f9828ac2da32727_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bda4d13f27b374503e52231ba92e03d5

SHA1
23d5ebc0e0e23a34f499828aaa68e3d344d04e98

SHA256
91dde4325da48ebc175e6225251f6ef7b2b629ce637d5aefdb0a3dc25da9bea6

SHA512
474760270e49df9ac08627a7f49e4b99b63d1f473314be97783f24076c392bb2963caecccc03673682b58a973ef1b5aea164957d001f22be67d80c6b6305dd9d

Download Submit
memory/1872-0-0x0000000003E50000-0x0000000003EC6000-memory.dmp

Filesize
472KB

Download