f89a7ee054c2d8c7c668e519ddcee3ea97b1b154a6c54214ac9b6af77426d743

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Esmeralda.pdf
Size

59KB
MD5

23c5d53057129a3d809f5b9f6779dcc9
SHA1

46db978bade81bded5555851449c45bfc5b51b03
SHA256

f89a7ee054c2d8c7c668e519ddcee3ea97b1b154a6c54214ac9b6af77426d743
SHA512

571eda06b4a1d3f561495ad7d60cd33d52e9d415c0732b732c03d180175c8b384b70a9ab6c17b0b83cd0e5dd20aa1bee6bff21fe8ecff2d3a99ec0fef1e44a18
SSDEEP

1536:nana/Ho+IMDSDQrA6A6bKeCF/qAcQpXsfVCyDNiCkbt:42Ho+jrWAKRqAfp+/0/bt

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2084	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2084	AcroRd32.exe
2084	AcroRd32.exe
2084	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Esmeralda.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f9e4aab7145bfffe8b779225f33a6c1d

SHA1
4dd99c74ea2ef0f0d0c5bbf3fadd5a9078860a5f

SHA256
a022d099d639133e3a504017194a27bf8ff5eaec0e6118fc070efb5529392992

SHA512
83997a8b4444e48a2a53a68da0730540329d3e1fc953c74459c10dd4a52d24b2eb84d82d2601f614279b9d229577fc8eb06779bc9c9cffaaba652c3abf98df39

Download Submit