e7e0291e665c4b94e90839f8e4af7a340df73d916dbe879592f7ff193dca0e38

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UWAG Dinner and Golf Event.pdf
Size

96KB
MD5

94b9684e99288b3d0139035bc85c93c4
SHA1

01b33b442253e33dcb9353d2afd30ee101a847bf
SHA256

e7e0291e665c4b94e90839f8e4af7a340df73d916dbe879592f7ff193dca0e38
SHA512

fc73f64271810cd449d754d1049914d302ee643c78585fcf4b35b0dee90ae627a95a87b32d789fc1012fd46505611bb19de02df2d61b5531b24b4ce34724f405
SSDEEP

1536:WxY16UhepfcWwlIf4K5p1EfYkMWrOeIKLsbyEi5z929UKzjkL:GY1theFcvlg5gQkMbeIPbyVCmGjQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2104	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2104	AcroRd32.exe
2104	AcroRd32.exe
2104	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\UWAG Dinner and Golf Event.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9c1a435908af87170c8f78995af15527

SHA1
32403afacad3fd41f483d296c0a10a05870901a0

SHA256
0dcb1393f4515d5fae7a8b9223035ca2cafcb3f958e3fe1e6e7d7a2e0fec17ad

SHA512
bd9e1dd765a645229a6135d6fbd49e78e61458e0b62fbffb59bd729f0c9f2f9f83a6a029a4fba2d95022edfcda472306513d88394348aef20f65c40d29ca0952

Download Submit