Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 10:33
Behavioral task
behavioral1
Sample
Read_the_details_gORg4TTIHeu.pdf
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Read_the_details_gORg4TTIHeu.pdf
Resource
win10v2004-20240802-en
General
-
Target
Read_the_details_gORg4TTIHeu.pdf
-
Size
4KB
-
MD5
6b645e96e10972dd4b0fd10a0867f5d4
-
SHA1
f5459cadd87d5da851dc4df8cd6e1133c4bd9b1e
-
SHA256
5c39c858a5cb618a03adc26e2b7e0679dc4f005bc186fd7fda6e41a6b5586ecb
-
SHA512
232d78a2a7da0dac7fcc7333472eb34f672dcfdaaaba976282bd7eee40d4b398f3aac292aec1b399e9a3d4dff0d2d29aacaa3f1a310590c670aaee827f469547
-
SSDEEP
96:14H+F6ohk6FRG+6VpGgjv9xipbMF+0dcDbuQKZL3t:EqRGVNviMj0buQKf
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2520 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2520 AcroRd32.exe 2520 AcroRd32.exe 2520 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Read_the_details_gORg4TTIHeu.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2520
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5e36da537e260aa1d8799d0c0d500cfd4
SHA1df1ef9a78e860547aabc5d356840134840847f3a
SHA256f48e2508e3045a47ec7ef3bfc75f588ed89279e318218af4ff1fe7833ba83439
SHA512c1464094ce9dbcd70939fa753f24888313b0632b7e7283d1038daa5e3a86ec32a1265d4523e45b18cb66a4e43dffd4210817d272a56d4be24fe27743fa5af39a