6f3fc38c0b9dfb9a0a491ed093665ab43c64e1083d609186fab592df27ef5c9e

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/01/2025, 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_f9d38f1c8d05461106a335c58894e1d9.pdf
Size

73KB
MD5

f9d38f1c8d05461106a335c58894e1d9
SHA1

0a89f9556ad40f693bbb02fb1f7580d13ae8435b
SHA256

6f3fc38c0b9dfb9a0a491ed093665ab43c64e1083d609186fab592df27ef5c9e
SHA512

208e80a6ab32cec80d217d1237d731fd42296b6d22580e603af777aa374ceda38bf0e63db6f40f5e28efdfe2e3c4126fab7ddb54b4b9b3084d00ce2d06aff222
SSDEEP

1536:ZaXFzqK9iUtj9aIRW3iOAwurW8pO7ojpws:IXj9iIj9aI+iO1u27ojl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2448	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2448	AcroRd32.exe
2448	AcroRd32.exe
2448	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9d38f1c8d05461106a335c58894e1d9.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
83ef8e6a416c18f95d51973b9b1455da

SHA1
0f0b0429e2c0fb09a4360f2c1e0656685c4fcf4a

SHA256
0b338e47dbce7dd27ecdba78ddf2ef3e8dd484d3b5de7afb1c84ee7c13057238

SHA512
c815a0b6e5d869cd8f355739b3ece155df23c2020521b1980cf1c19230221a5a8485e2e5e867fbfd39bd69538f295735c4647a65481b71b4db3dd0e1742c77f1

Download Submit