a2b58d6dd143e8063a11fe04af744c7b15ab03d169c94c33922ff769c7d85a76

Analysis

max time kernel
98s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11/01/2025, 06:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_fa01b11bfe7c62a04b79a0195667ae99.pdf
Size

63KB
MD5

fa01b11bfe7c62a04b79a0195667ae99
SHA1

16419bbe8b68aa0525814b782ca1c9ec97aa94bc
SHA256

a2b58d6dd143e8063a11fe04af744c7b15ab03d169c94c33922ff769c7d85a76
SHA512

56e89a4c6489c87f3a13b818519a564f7aa0cad0b4be93883d8a9749a6f532d0840128d9c3c7e40b5f10fc838b50483c0f607c0b0a37db401bd535060b0ba8d2
SSDEEP

1536:tWJooY0yBeDBjli69oUZd609hhhmKXoydoq4s2fktX:SyBefiKJ/zd4fQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2280	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2280	AcroRd32.exe
2280	AcroRd32.exe
2280	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fa01b11bfe7c62a04b79a0195667ae99.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
751ba55821fe6e7392ca045f384e89ad

SHA1
4e5b3c53f48603fe073685b52321ff0bac091d25

SHA256
bdc013e910e378c2de1578fd6387e3967ac2bb83853e460eb9fee467ac2bbcd4

SHA512
437bb6e8cb70dcadc9fa6ac1923cdfb3880dad71e64f32dea9ec3df1f16c0a7937f9adc0bd57e179d824fc2187477709249d5118cc48a5f34ce8dd8a2f558409

Download Submit