430336a21f44aeebb4c6f8da5536c5b5b149265b2a6371ac0dfcb410f528ed26

Analysis

max time kernel
94s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

thinkphp_2.1_full/Docs/ThinkPHP 2.0ȫֲ.pdf
Size

2.1MB
MD5

afb3c914ac20d3abdfc5a385b5551077
SHA1

d001c1a4417c8d41da136eabdab9a679ba6ecfd2
SHA256

0d71dc87f8ef2095338fd9f5384494fd5f14b2db9563c41dcbd3b6713b0cb2d7
SHA512

3fdbf69a29ed8b805ae31afdcccc21600846b25c4d4d61ccda2eaa32cf630d773abd5b1d677c59f23cb51757e143e1fa1f19db743b3ab5a0cb46c61d0138de69
SSDEEP

49152:0WWuFeyK1lOoa9x7yPsuVe+DixTScsDLmoSsBCOkkr:0WhkWoa96O+DOTSDeoVCdq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2316	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2316	AcroRd32.exe
2316	AcroRd32.exe
2316	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\thinkphp_2.1_full\Docs\ThinkPHP 2.0ȫֲ.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7f9358c2843126c9a0e6837f798d6968

SHA1
a1683fea6eb3ea65a03d5ebd7d1f9b82a594db9a

SHA256
0e76400cbb3162a48170022c5c705969874c15076a988b9b207afde24475feef

SHA512
edc8c814705befc42da8b4a89fe3f4e455f01be3da6f015e039ef22281d8ca2d3ed797052b159531e0631e35215f47d96fc99e7c08ed71af3373890b362b2135

Download Submit