cae1156dbc8355fbbb11e4a8f3cbf0ebe83c41b3e8bd7b6e850493eb47dedd22

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/01/2025, 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_f9e50b332c651a20951a90c80e9ea090.pdf
Size

70KB
MD5

f9e50b332c651a20951a90c80e9ea090
SHA1

985d64f000265c5b0c374b85d25f24d94e8689ed
SHA256

cae1156dbc8355fbbb11e4a8f3cbf0ebe83c41b3e8bd7b6e850493eb47dedd22
SHA512

6ea480373c9f780c45076bc52120dda75ca310d073207aa1bf2d93ffd2bc918d90b4a22d0cee8f0723abc519ea80125e9894b4376a6218be86be1cb4e61ad65e
SSDEEP

1536:ccY0+3t6g1zLCWBxJu3y4gwQDJ82VZWkNpOPaWJ+ABP+2+Tvr9k:q0+3PzLCV3DxQDJiPl+1TvS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2764	AcroRd32.exe
2764	AcroRd32.exe
2764	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9e50b332c651a20951a90c80e9ea090.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
deab791def6469747ebc86ac1daa0cfb

SHA1
1207a44ba71a89e9f1728b7cad294b795b2cb10c

SHA256
c75f9ab0a7816ba34cd5d32329052211db878be6b8a440d39a6f4caaf40cf486

SHA512
629b9fb8efcfb338573b28d3c12131f2c98719bec967acfcdde8f0d8709b628abe6aa9f56f0b039b7605c5767e780d41459493e64b82a71f1e4f0895e10360c9

Download Submit