Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14-08-2024 06:07
Static task
static1
Behavioral task
behavioral1
Sample
1099.pdf
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1099.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
TAXORGANIZERpdf.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
TAXORGANIZERpdf.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
msimg32.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
msimg32.dll
Resource
win10v2004-20240802-en
General
-
Target
1099.pdf
-
Size
40.8MB
-
MD5
6ae1a9d8b283b8da4ec2d1fb01090d74
-
SHA1
a3d7592e8af160f5b233abe007e9b8c29b4d66bd
-
SHA256
1b8a78075bdac18361ffbe3b494b8095a4f64a2b95d18c5554bd588c84190621
-
SHA512
6a9b116ddb29af6017b54d8a103fa46d6d3ee2e63613dff146edb99b1287c1c61b7f0ec113a6e93e17c65bcef843a2a989eb5373bdc57298d0b0d6ca0b3d1519
-
SSDEEP
786432:U4Gbn+40bnZ4Ubnd4Ubnd4XbnT4mbnY4MbnR4UbnUEU9CGqb+:U4E+4aZ46d46d4LT4kY4iR46UEU9CGqC
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AcroRd32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid Process 2564 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid Process 2564 AcroRd32.exe 2564 AcroRd32.exe 2564 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1099.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5e1712adad4dfeaf28c1cb6b0d1d4c5c8
SHA1956fef72614df3d25a4e6c592fbcf9652484a1a0
SHA256fb97839f612e511c1f955a57af46904f3b794d3a21216b361730a8deefd1ab53
SHA512ae4c66d50aa864ca0741bef29a210ace18810e78c31cdbd5ca049c0748c2deb48f5465b8bbafc562f8ad114d3fe9b6abcbaf6f89d5dccc44b0694030fc014297