713c00145ef4077e490bfd640a850a88e6b95b7c13ff21f443fa4545c98de7d5

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_f9dcc5768b573bdf531755fee8884cf7.pdf
Size

83KB
MD5

f9dcc5768b573bdf531755fee8884cf7
SHA1

1d9b204f21249a0265a29ed1889bdc11ce778ad3
SHA256

713c00145ef4077e490bfd640a850a88e6b95b7c13ff21f443fa4545c98de7d5
SHA512

3ed7a0575a81fd6652e0e1d7aa6b1b5af73a844d644272a9c99f430193d22139981aa461c05b6080c85dcd865fe443f002051ea5410be7c90af4fabc38c1a9af
SSDEEP

1536:BE43sS34hVl3tpE4kAUyEpmyqvds3w9GPWwhixSWxWFTXzOqwrW8pO+BrV:CosSo3l9pR/3STqvds33PWwcxXmoy+j

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2532	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9dcc5768b573bdf531755fee8884cf7.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6dcb85f50476f2bdcc80f8b86a4decf1

SHA1
cfd92a38830c7533d5f964c726c35dad09ab412f

SHA256
118b573fd968dfc8adecd561bd879cabf1174a609ebd664c897c4f259b17a383

SHA512
f48e8ee9d42c9db4f873f0e19c685cec5dcd914b79b28eeb634295f4ca8301c03e95b295ab87fde3639f24148a44dbde9a043c3e38d97e95d43e72808146a465

Download Submit