6d7a257e34261f8c88e355658881a50a056f8600e2e57ac0b24647a35143e1d2

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

__MACOS__/__MACOS__/__MACOS__/__MACOS__/__MACOS__/2.pdf
Size

46KB
MD5

30a1322dc9fbca10e24645dc66f67505
SHA1

6d31c766e8016e8ed31b80f5988afa12aeeb90e6
SHA256

34b9cb28a8da599ccc136a22a8d7c1c754b28f60f0a9171141996d829a172288
SHA512

60d99c2e635d90d89cc72660852e44befae0e3ce46093a6e30b55568f6f57fc0c81f1413b87b00ac234279437c3de79e72beebf8e6b047aa5eee1c601a03df99
SSDEEP

768:aZiirtDOzHTZvNIZwGLKvR7AXoU8fjrj581orjrjrjrjrjrjrjgrjrjrjrjrjrA2:UnrUzHNCyGWaaf5+offfffffgfffffky

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2676	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\__MACOS__\__MACOS__\__MACOS__\__MACOS__\__MACOS__\2.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
240a754d4f43b9931ed2fcba7c3a1ed2

SHA1
98c92f760a0cc0fed013f13b7ca0bc0cea06b25b

SHA256
7bcd8cce327087fcc27e0040fda5484141ed2175e7ebecd786094d7f635065b0

SHA512
ff57fb86769bd34604dec0e7c166fddda32fd05844cb6a5ed24f12021f3f87cdb1c489d139bb73d6700ab2f750c5317bee91c742c44030119f7c70e4d1bb2aaa

Download Submit