31e2ac1d5595bba0ab7edbb7275f3eb35e4f68c640ae7bb8ec35401199efb55c

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

W-8ECI Income connected with trade and business.pdf
Size

78KB
MD5

e7cea0ee418d87e40a8bfb1297d02272
SHA1

93a868717aac33a1945fcb596b3af9a1e93362b3
SHA256

e8fd980376228d3636498889c4ace387055190226fffafcdbfc2e9c88c8b1f31
SHA512

ee0eb15b4fdbd59372ebcf48ca43226ec0029d6f257b22aec96d19491096e109c81825803ff68afe5e364b89a776bf60d82bb59544a10e0f0e056c919e9cf882
SSDEEP

1536:XFMF7G1liISveOtCA2rAEnZaz0UmLbiPTdko:2F7G1lM2OtCA2rVaz0UmbOTdz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2204 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2204 AcroRd32.exe
2204 AcroRd32.exe
2204 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2204	AcroRd32.exe

pid	process
2204	AcroRd32.exe
2204	AcroRd32.exe
2204	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\W-8ECI Income connected with trade and business.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\Security\addressbook.acrodata

Filesize
5KB

MD5
4618312ec50b52c81043bb6ff393cfc3

SHA1
80537497d939529b34de993b14d96510068bf075

SHA256
e8e27396e2a043abd283eed4fd5b8fa256cc22e741defd522158fc9e29205839

SHA512
fc589a974f35ee83c297784c7d7cc62826854422ceec2d5ff46aa6575f5b2bade27d26c1dfc0686602c81e5c14f75f7abd23e6c19fd90a2dbe70e0f5c09251e9

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
204fe4721cc498f9330adce5a7d6ba9e

SHA1
aefce84922bed9f1fddf95f5e55f50d2999f2ee3

SHA256
c7bffe3a3af5ccd2536fdd009db0cad40cc4d0d2f1c67d7d7d2980b8b14437cb

SHA512
afd5b565a9694ac564d69d9af783ed187f0b72a4ec1894c3351b01861292a1e90377b688a95818301f9392e063a8c84f2cccee79ae86a506d1fa293e004a43ec

Download Submit
memory/2204-0-0x0000000003A70000-0x0000000003AE6000-memory.dmp

Filesize
472KB

Download