8e4ac71e32cfa66547eb3576135de893ca9e03ea93b276683d89bf219856b8e4

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 20:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

info.pdf
Size

1KB
MD5

940d95a1da6a3d8ad7ac0e01b8b3ac44
SHA1

93882250da7b8f3da2bf0b4caadd75b7bbdb9523
SHA256

d0ab4de11b4c8064e216323807786d3bc2156e54befc8bcb10174eeba16cc73a
SHA512

89071473042c463c2968f3ddd3c18351fbf836762b2b32d24374e109c0e9ca24a7f9cedee0b3ebb996dcf25912b998c95c79e12bfcf07bf6cc9bdf36f8a6643f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
656	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
656	AcroRd32.exe
656	AcroRd32.exe
656	AcroRd32.exe
656	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\info.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5ec64d434a1453a77bcb48eba0b1ceb6

SHA1
141afacc735427a73581df9a173c34c84764ddac

SHA256
eedf4da4392a46afa22780844a5d25f8db19698ae568fd167a8ca4564575a4b7

SHA512
0e08455e5fbadfe1b8e661f09b07943a86b83cc1cf24c201dfaaca7c5698735b699aa8fa324dfcdab089a0fb350539f3f40f7fa7dcf2892017960e9344ecbb5f

Download Submit