Overview
overview
6Static
static
6W8 or Cert...ms.pdf
windows7-x64
4W8 or Cert...ms.pdf
windows10-2004-x64
3Certificat...us.pdf
windows7-x64
3Certificat...us.pdf
windows10-2004-x64
3W-8BEN Ind...ls.pdf
windows7-x64
3W-8BEN Ind...ls.pdf
windows10-2004-x64
3W-8BEN-E Entities.pdf
windows7-x64
3W-8BEN-E Entities.pdf
windows10-2004-x64
3W-8ECI Inc...ss.pdf
windows7-x64
3W-8ECI Inc...ss.pdf
windows10-2004-x64
3W-8EXP Tax Exempt.pdf
windows7-x64
3W-8EXP Tax Exempt.pdf
windows10-2004-x64
3W-8IMY For...ip.pdf
windows7-x64
3W-8IMY For...ip.pdf
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14-08-2024 23:13
Behavioral task
behavioral1
Sample
W8 or Certificate of Non-US Status Forms.pdf
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
W8 or Certificate of Non-US Status Forms.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Certificate of Non-US Status.pdf
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
Certificate of Non-US Status.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
W-8BEN Individuals.pdf
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
W-8BEN Individuals.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
W-8BEN-E Entities.pdf
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
W-8BEN-E Entities.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
W-8ECI Income connected with trade and business.pdf
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
W-8ECI Income connected with trade and business.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
W-8EXP Tax Exempt.pdf
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
W-8EXP Tax Exempt.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
W-8IMY Foreign Partnership.pdf
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
W-8IMY Foreign Partnership.pdf
Resource
win10v2004-20240802-en
General
-
Target
W-8EXP Tax Exempt.pdf
-
Size
123KB
-
MD5
6277a14af3ddadc765720bf6c0b0cfc6
-
SHA1
437cb905bb73b67b1e230343ae32923da3b09674
-
SHA256
c3d48afbd34a08aeb81cee280e1645a84bc06f0351c20704f7dd98694d736475
-
SHA512
eb3077f74e09a025ceb905ddc4807de5a5836ab6fa141a3e7b8cce13d338534e84077884824a95255901789df005dae3cf34dc2bed693ab9bee5ca10d4022a67
-
SSDEEP
3072:3nHwIBqfeSiim8BeKC7/tfxjPhaFpxovHKaC:dqGS3sAFMvHpC
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2316 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid process 2316 AcroRd32.exe 2316 AcroRd32.exe 2316 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\W-8EXP Tax Exempt.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2316
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD54618312ec50b52c81043bb6ff393cfc3
SHA180537497d939529b34de993b14d96510068bf075
SHA256e8e27396e2a043abd283eed4fd5b8fa256cc22e741defd522158fc9e29205839
SHA512fc589a974f35ee83c297784c7d7cc62826854422ceec2d5ff46aa6575f5b2bade27d26c1dfc0686602c81e5c14f75f7abd23e6c19fd90a2dbe70e0f5c09251e9
-
Filesize
3KB
MD5f9ccc8795a525a825bc2cf699f03c421
SHA17c4e92dfe34f238290d14aa791af8a3322774ed3
SHA25657864156ceadc309e13b4cdbc25fbd24d8babf73dde8aad36c6eac5d61e26811
SHA512363b8adff8e67fecf656668209dd97fa3ed4dddd360e8abe59226bb1b499034e7d58d99e7941b3d584246d9ecbe55185a510940a2851ef4f8e9b0fb7d9ecf680