72036bb704a0f33319c7ea232f1cee4b0218a2633af8ff2981251cafeff9dab7

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/01/2025, 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_fa053aa4c92ab0b55eea0078baed01d9.pdf
Size

74KB
MD5

fa053aa4c92ab0b55eea0078baed01d9
SHA1

4d6133c2a19af875e267433a36352dfb01fea582
SHA256

72036bb704a0f33319c7ea232f1cee4b0218a2633af8ff2981251cafeff9dab7
SHA512

e718ea1b773ac00433d8546eeabdc49adc9e25514e8075e7374b559700968943b23a50efc58d6b25c084210a967762dc6fce2471037c831663894bdcf845fe01
SSDEEP

1536:rRl0oJo7r1LFGj5b06VfJNVVOnSWOpOaZ9UD/HK6W2BkRgJLPgGzb:9SoshFGFI6fJ7V4naZGyUyRWLPH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2912	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2912	AcroRd32.exe
2912	AcroRd32.exe
2912	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fa053aa4c92ab0b55eea0078baed01d9.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
84262781f314b0c560d643db763f808a

SHA1
be164f0d5601ba8f540181275c24da41b9c7f7df

SHA256
f8ff7fbc470c66613b2d22301804b134605b0f130815d5d25e4a1f69d107c6b4

SHA512
2baf7d8bd83e5dae7abbe78a77c010370df3bde513d110285369db55cdbc66e3c4a91da8aae7266a2375eb194549fabfa022fc5a3d2f24d11c0a2974b4cff4b6

Download Submit