b7b74d4478cd6b0f2cca03cb5a8f15f9fd196e2d86311ac77245c35a3d5d9f13

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
21/03/2025, 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_83d4239e6eb6b4f8e17e315f0ab0a6ec.pdf
Size

1KB
MD5

83d4239e6eb6b4f8e17e315f0ab0a6ec
SHA1

2491fb64fc0c1f02940b73023e798dc8880d064c
SHA256

b7b74d4478cd6b0f2cca03cb5a8f15f9fd196e2d86311ac77245c35a3d5d9f13
SHA512

db37547b4178c3b42c6d1e598141e35fa47c1b18e1b97a03d5e503127ee001fb87b4c2c14ffe8df6310b9c855b3be2f521a8dd2d56a4032927bca202e7eca980

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2352	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2352	AcroRd32.exe
2352	AcroRd32.exe
2352	AcroRd32.exe
2352	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83d4239e6eb6b4f8e17e315f0ab0a6ec.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4022a824e25d076093a55c3d5ea39eba

SHA1
c4309914373ec1bf8bad82030439192f46342877

SHA256
54d8a0936af221f4f33ce9e30a30a403ed2067b5bac542447847fdc7dcfc8375

SHA512
56f7065cf3adda6390b071c4b6067bb69b189da02b48811ff7be451e24d6f846ec5db47f1e90dc1d9901ab120c50a5f1403c1775ba8ca0d2a30ad7bf61c2ad05

Download Submit