430336a21f44aeebb4c6f8da5536c5b5b149265b2a6371ac0dfcb410f528ed26

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

thinkphp_2.1_full/Docs/ThinkPHP 2.1 RBACʹü.pdf
Size

936KB
MD5

da1574ae2ac21c606740e39fab5d3949
SHA1

7e01e3c005fc781524cffff6f169099dcd43a3d4
SHA256

f095a5b7f6f970454301d171915a256e0d13534087a0ecd95d45f014dddd1c1d
SHA512

301d3c63a0e7da802406f6175f998e56cf156e6cb7e003ab4437634f88caf425e3b0b54a22406d0aeb6c9e58bb56c8261dcf0bce0d219f839a5ffc6dfc77ee43
SSDEEP

24576:hq6WtllBiAKJ2W/Y/YJY2T5VplumAa+sWZFupKAuLn69AI/bIo9auVe:g6W5Bdk2gNT5VpcmX+sWZFceLn69SsaH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
624	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
624	AcroRd32.exe
624	AcroRd32.exe
624	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\thinkphp_2.1_full\Docs\ThinkPHP 2.1 RBACʹü.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a4259881374d2ad7c129561366920a58

SHA1
5484200299cc49d6758f5c64338ea29bd05c1cfc

SHA256
2c093df1cd02beef9a56e21371b213e90512ce131d37b592b1cff9821ef2182a

SHA512
63cc76452b26a85a8b3161146c06cd612d98ce6f7facc465b8b10fbfb349a72a5c19c102c7f5b79e014a8ab51f7981efc311e05849fb29463cfe300626d6e8a9

Download Submit