926f85d668e9f561c81086f68fa9a46b39bb4536286b280d6be776f8b6351b0a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
10/03/2025, 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6098bae7aa2b010d80bb0b3fce2ab94b.pdf
Size

8KB
MD5

6098bae7aa2b010d80bb0b3fce2ab94b
SHA1

45b9b7ad78563bd5ac68db8e924285fbe0cb359d
SHA256

926f85d668e9f561c81086f68fa9a46b39bb4536286b280d6be776f8b6351b0a
SHA512

eb628ffbc16a0707a21c911b3cccad3eeea4bac774b77b107b1dce0185d60272431e153fa002802a6033bf1d53e1544e34d8a4c0f1d80475170a69eb08ffd17f
SSDEEP

192:6NmHsYaYWxW3nrJSJArmsEtS3CcwZCMdY8qcLq3IYOJABGZNxX:6NisY3b46AcQuv4tNNZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2336	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2336	AcroRd32.exe
2336	AcroRd32.exe
2336	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6098bae7aa2b010d80bb0b3fce2ab94b.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9d749b9cd1d3d4febcd9f15adc462818

SHA1
36af4e45d970c982bb2f659782c8ac3eebaeddaa

SHA256
8257bd01f0ffcc4b929e01f83fb8cb9829a5575ae34e0bb968a3059a69b46b8c

SHA512
6ee6bae5e3531b0ef5007f094a343202a4af874665e6d86a27185bb9ed0d0dd230af32e6d162591d6617b0836d3d6776ceb214ace5fcf4f36a4fd3443846cc35

Download Submit