2a317c4fb8de70541b1daa06fa60e10fa8cc9d725497d003c7351c831dfdcb49

Resubmissions

06-09-2024 18:26

240906-w29p4s1fpl 6

16-08-2024 12:29

240816-pn7j9sydlj 6

Analysis

max time kernel
359s
max time network
361s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-08-2024 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IISS Prague Defence Summit 2024/Annex 2/Annex 2 - IISS PRAGUE DEFENCE SUMMIT (8 – 10 November 2024) - Copy.pdf
Size

202KB
MD5

388ebe1c45ebdf3ce9e4631708adb49a
SHA1

77ac70b8b309d62bce551bc544279fa9e07325f0
SHA256

901d713d4d12afbcee5e33603459ebc638afd6b4e2b13c72480c90313b796a66
SHA512

1e87b788c8a0c3acf528e323b05e8c2cf8ad7233eb40304e37d059c5675d6c9731d1ace895605c61d2805836367073f9e533a8fde45e4744c4cf61efdf0d2814
SSDEEP

6144:SjljdmqTXptU8sKXCEJZHvs7nrRsj/Sk05/uc+:QjE8HJ5vqnrRsekMx+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2468 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2468 AcroRd32.exe
2468 AcroRd32.exe
2468 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2468	AcroRd32.exe

pid	process
2468	AcroRd32.exe
2468	AcroRd32.exe
2468	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\IISS Prague Defence Summit 2024\Annex 2\Annex 2 - IISS PRAGUE DEFENCE SUMMIT (8 – 10 November 2024) - Copy.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f59dc2931e8af520e9dbb7075735363e

SHA1
e604efd09f58421f950864bfaeb4552ef2e067ea

SHA256
a718f1c6aac593aa8c1807141870510ac9fc492cd43f7c9e1d018b2c29ba4939

SHA512
dde3587cef2b09cf6d2c529095452ac7a8144a7519d95696b3a67eb4081e679d96eb12edef9dcdd3b00daa47b29a746f42d83a164f82b0870071e0fddc6b0b64

Download Submit