8eb6945907c07f04bcfd3d70dde85c2c6adafad1f5a11008df67882a5220f767

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

__MACOS__/__MACOS__/__MACOS__/__MACOS__/__MACOS__/2.pdf
Size

46KB
MD5

30a1322dc9fbca10e24645dc66f67505
SHA1

6d31c766e8016e8ed31b80f5988afa12aeeb90e6
SHA256

34b9cb28a8da599ccc136a22a8d7c1c754b28f60f0a9171141996d829a172288
SHA512

60d99c2e635d90d89cc72660852e44befae0e3ce46093a6e30b55568f6f57fc0c81f1413b87b00ac234279437c3de79e72beebf8e6b047aa5eee1c601a03df99
SSDEEP

768:aZiirtDOzHTZvNIZwGLKvR7AXoU8fjrj581orjrjrjrjrjrjrjgrjrjrjrjrjrA2:UnrUzHNCyGWaaf5+offfffffgfffffky

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2240	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2240	AcroRd32.exe
2240	AcroRd32.exe
2240	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\__MACOS__\__MACOS__\__MACOS__\__MACOS__\__MACOS__\2.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ea2ff6e34d7f7bc08b5aa1f2cd3be5ba

SHA1
e122e98ba608eb45c595c1b43219a85d962b0177

SHA256
3d67bc3f4bb5f2b94f72a131052327a87a55b08ab357ff99b1871a4b585c5a89

SHA512
42d1e40392b9fde13cea74895eff8650ef97c82645a4459a05ee2698c83ff15f927612ad953dcd6d756eb7db891864eda6200205e2d6bbea9f398001253450f8

Download Submit