51723a35ca9e3f8fa9309ee9d97146f6fcdc82a403dea87880fa4f8dcab6a17a

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/01/2025, 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_f9d0d4a5ec1c449ef0e62132faae10ff.pdf
Size

35KB
MD5

f9d0d4a5ec1c449ef0e62132faae10ff
SHA1

72fcc4f77777c8566ae6c3d3493da29cfb24fc64
SHA256

51723a35ca9e3f8fa9309ee9d97146f6fcdc82a403dea87880fa4f8dcab6a17a
SHA512

2e1462abf34662e2c8e7191667eba1545479012c1ee148d0deeeb6f0f7f98c2e5700979a087b0c319daca683d9089793571bb0bfb297617d4a79a9d1efeafa08
SSDEEP

768:RbUs3oJMpsaFzaCp2AuJ4T0AeQzdyg31EikSFq:BUs3o+DuJM0AeYFySFq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1524	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1524	AcroRd32.exe
1524	AcroRd32.exe
1524	AcroRd32.exe
1524	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9d0d4a5ec1c449ef0e62132faae10ff.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8a25d0cb19a63f7c7173a0a3fd7c9bd9

SHA1
2c42a6fd35a5d1d8860ee9ee730dcc49bc760d0d

SHA256
13748339900b4652c71b6b5146998d82102f9d952a76aa5ff9b61380635d4094

SHA512
fc8a7a42c0ce245cc2649af9d7c321bd5063e6214064c4be6368a8d58a12c8c47961a1c97f6355518bec21d737f0e488493ed7891dbe4e606907a7b472204e40

Download Submit