97dc3add361d2c4925b18a29b950b54c9f17c5f8444e30c4f8d9ec881e564487

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19/03/2025, 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_80213d77e0bd0c3be1b89e5b1d35e4c1.pdf
Size

12KB
MD5

80213d77e0bd0c3be1b89e5b1d35e4c1
SHA1

5c44b7a7c2a2348405cc024b9c5b56052c310090
SHA256

97dc3add361d2c4925b18a29b950b54c9f17c5f8444e30c4f8d9ec881e564487
SHA512

2d2507f2c9a68b5940f308310fcf82fb6b4607e3a829442e6e7af9705cbf58c5d8f13031359df14ba69fa4b700af8e1aa703ba48a69a66a61e60dd5b43e393c3
SSDEEP

384:AHyGGehTCSZfRbEoM3fDCvvA0+Q+P7rofQLCnjR0g:AHyGGiOAfpE13fMvAJQ00fQLCnjCg

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2064	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2064	AcroRd32.exe
2064	AcroRd32.exe
2064	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_80213d77e0bd0c3be1b89e5b1d35e4c1.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c79ac256491bdb68628bfd03795ab170

SHA1
322873037c03d5dda5700b07894fa6f222531997

SHA256
e83d958f828850c3052491a230cf81420580f8638184df233f7d4b686047e0f7

SHA512
9e3f3224f14d55d48a8c0565e8d776eb4d61e9ae03ac6673abd3340ea4d945838531a6c324fa1cc7575054c6c999c31d8d5e100c34a3974864218286fd7033e7

Download Submit