2263edbf02ba2737c70d7192ac1edaa434eff00132556960e8771d661c2d36ed

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Read_the_details_gORg4TTIHeu.pdf
Size

4KB
MD5

6b645e96e10972dd4b0fd10a0867f5d4
SHA1

f5459cadd87d5da851dc4df8cd6e1133c4bd9b1e
SHA256

5c39c858a5cb618a03adc26e2b7e0679dc4f005bc186fd7fda6e41a6b5586ecb
SHA512

232d78a2a7da0dac7fcc7333472eb34f672dcfdaaaba976282bd7eee40d4b398f3aac292aec1b399e9a3d4dff0d2d29aacaa3f1a310590c670aaee827f469547
SSDEEP

96:14H+F6ohk6FRG+6VpGgjv9xipbMF+0dcDbuQKZL3t:EqRGVNviMj0buQKf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2520	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2520	AcroRd32.exe
2520	AcroRd32.exe
2520	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Read_the_details_gORg4TTIHeu.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e36da537e260aa1d8799d0c0d500cfd4

SHA1
df1ef9a78e860547aabc5d356840134840847f3a

SHA256
f48e2508e3045a47ec7ef3bfc75f588ed89279e318218af4ff1fe7833ba83439

SHA512
c1464094ce9dbcd70939fa753f24888313b0632b7e7283d1038daa5e3a86ec32a1265d4523e45b18cb66a4e43dffd4210817d272a56d4be24fe27743fa5af39a

Download Submit