2a4be227c307f6b7999ac91628838171f60165452b29b709d4d889cf33870a1d

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
11/01/2025, 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_f9dcfe74efdb786e3610e14cb2c66565.pdf
Size

70KB
MD5

f9dcfe74efdb786e3610e14cb2c66565
SHA1

282f9e7be080fd40ec2219f5cd064b06e2f8c31a
SHA256

2a4be227c307f6b7999ac91628838171f60165452b29b709d4d889cf33870a1d
SHA512

be29ea767c60f140cb78a25573fe0d77e9ddaad8f4bd69581ea1932222d01668313ac4be596791cfe4a838d120af14e50410e2a78e2a137a05573647ee41b6c4
SSDEEP

1536:H6Q1FsUSNwuJ4B5z8FZAXWEsdCiAXv2WypOlL6CZW+tbh+eajtDkp:aomUSNPGBlwciWPlL6CZt9+eCtDC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2504	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2504	AcroRd32.exe
2504	AcroRd32.exe
2504	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9dcfe74efdb786e3610e14cb2c66565.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cff1a12daa5ad184ac8138e16817759a

SHA1
c6003cd0b36875e7d2967c5f447f7c66c8f59816

SHA256
febe89a47923e1a39780bbb13a671f915c8be70b82217ada61482c8de16c122c

SHA512
d351e9bb6a179a5bbe1fe3a7a0dc6e995851261dd03a7256db29b18fac27b5887f769de167d4cc0f2b45a136631dc4e435eb17670bad505ab2e0ed34872f5a8c

Download Submit