5a661e0b60d4e9f7d42b321a9c245a1bb22f44d5f7de3d31230dec9847ad83ea

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sps-public-24081416520.pdf
Size

127KB
MD5

4e198e7ae0b6459474ff1549a6a0a3c4
SHA1

87574afbc4fe743cd1c8b6dd8535bf5db61418aa
SHA256

db99701acb58c35f37a420028815e7c6db57cd96168fc1e60eb0ada170839ee9
SHA512

c64b9054fb6ea4294ec48347bc0ce5218368c2d72aa9f2b2a73be8c12457958354ad853aef848c729dd6ee4d7d5f2d39fe27c93b2b8c0a78993526b89dbc11ef
SSDEEP

3072:22TGDU2zToApEgC28Q5Nv+utOknXEuvpwvSyfARYJ:7gzTNpJPvRXESwv94eJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2292	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2292	AcroRd32.exe
2292	AcroRd32.exe
2292	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Sps-public-24081416520.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a189a4802bc23d81dff670087a4a4724

SHA1
15963c2dce0890ea0621cf808eadc23e42fc2535

SHA256
ca8712f98fe6f9a9e642c5e25f91bbc99434cd0e539e8a8218f13012ad06cd33

SHA512
6699c2c880ed4789941301ae0b6532a8a1a491992c092a2e9f49fe1931e108d38c9e9d52d59f0e49893c9afdee46effc01015e76a4abe32cfaccd7444f70f607

Download Submit