f5179008d8cea13d5d5b923e58cea8dc8e3c62646ab2c578d57cb0d2970f399c

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/01/2025, 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_fa09dfc1e1a7f9da6fb902e799c72eed.pdf
Size

78KB
MD5

fa09dfc1e1a7f9da6fb902e799c72eed
SHA1

60ee8e133c86c6c575980ea8c5863912b8cd16a5
SHA256

f5179008d8cea13d5d5b923e58cea8dc8e3c62646ab2c578d57cb0d2970f399c
SHA512

1ff19157aae06f0a699c76a6eb585bad33256ecc1fd72a404f03beb8fbecc2b80144fb0c7b8770fe15b9b623d1604707ebcc9796bb937d6fb9d8aab1e3a60315
SSDEEP

1536:nghIP7p2d6Nf0qjNXJryf8l8WDl3WC2DKAJ2VWwpOSXRy:gSP7p2doXJryEl8WDRGK38SY

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2280	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2280	AcroRd32.exe
2280	AcroRd32.exe
2280	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fa09dfc1e1a7f9da6fb902e799c72eed.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ec5849ee3b522971ade1d0832de2fbc3

SHA1
665b3dab4a3fec34f2bce1323a79444c27e43a83

SHA256
6ed1ca5d02f2f1ddaef32748780177fa3d8daedccc11bcc4d569693686a537dc

SHA512
188f59ba818b8ba3f0ddaf5c9d5e210a496af66789ff44bd5bec45acc74431d11d214529e2715d263f41a04f7641a97c76a939d51dcde6db448f186a6856f04d

Download Submit