430336a21f44aeebb4c6f8da5536c5b5b149265b2a6371ac0dfcb410f528ed26

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

thinkphp_2.1_full/Docs/ThinkPHP 2.0 Q&A.pdf
Size

1.0MB
MD5

a33c8e259b75ad3ef23be2f42733ee46
SHA1

cc108f5be9d57c2854c5f2e1855e3216e1a80799
SHA256

063125f4d3546fe17a2f67f0f5bf363684a23e55d18d9e31e85bdec26124be36
SHA512

456533ba58d6433eadf6e88914bb9732347d274069a6054ebc2afa2a12cbfb79ff8763da888510963986035dea8d113641f2b2710bbe1097796b5b3e581fa9b1
SSDEEP

24576:g8WHufpuJY4Gv/+9jy75hxG1oQfkQV6I+gxtzoHp1LUG:g8WH6yIG9jy7bYoQMQsIbrza7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2260	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2260	AcroRd32.exe
2260	AcroRd32.exe
2260	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\thinkphp_2.1_full\Docs\ThinkPHP 2.0 Q&A.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
91769b4ff9732e61cb577bb3e2708c4b

SHA1
b69606e253e02a535f4b9223f8dfc8347feef7cb

SHA256
a593fd0fe17ed2fcf465643e136b142fba6459a865e4c10980968cf2e820deaf

SHA512
2338b31dffc78cfa661777ec615ad2119ead35b045c817973a7ec3807b7df4c4651f1f822e2c170121f3171da5912e63436a0de519d7c206e28f7c2e10487a9e

Download Submit