8744ee87d793fcc65f93fc7d0cd65f9e04388850d15ba5f2a02682b35ceb8678

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Docs/PHPB2B2.4Manual.pdf
Size

431KB
MD5

784880b1c031fc169909e5406f4cb7cc
SHA1

bfd075ada60c700e04ac12ad2621ccbde2aaf5c6
SHA256

7d7ad1a9a11275e3ccc5f87a05d4750cf07d293856028b886d7c885d784c0ceb
SHA512

0f74e3d96287fc236b75709809c317e1b44c7e817cd832b515b4e706f8ee7cc98439f7deb477f88547bc8352c929d04c31f28783897878b60ecbf09fa3170337
SSDEEP

6144:U0vvQw70QDvNGJF5vpCeDh82foSIOljpYMQrjk3qHWi18jTqPWUHeogc1kkK:t57lGfpy2wSIOJpYUjmPWUHenGRK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2812 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2812 AcroRd32.exe
2812 AcroRd32.exe
2812 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2812	AcroRd32.exe

pid	process
2812	AcroRd32.exe
2812	AcroRd32.exe
2812	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Docs\PHPB2B2.4Manual.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2812

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
c1db98ba3a5f77212d91071e378c21b4

SHA1
6e80694efcc34afec3c023fc28ef14db0eeb1d89

SHA256
c3c1b6a163cb9d24970cf05117d119112a8714872e89e55482e2951ed548522c

SHA512
9e069a984ac2d7550918a028f12cc6cac3d132e0b5bb847ad48b3b2ed3edbea121cf81482d361036f358b0f2bd9e7291aa96a9c59b6436897a8538abab710461

Download Submit
memory/2812-0-0x0000000002600000-0x0000000002676000-memory.dmp

Filesize
472KB

Download