2a317c4fb8de70541b1daa06fa60e10fa8cc9d725497d003c7351c831dfdcb49

Resubmissions

06-09-2024 18:26

240906-w29p4s1fpl 6

16-08-2024 12:29

240816-pn7j9sydlj 6

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IISS Prague Defence Summit 2024/Annex 2/Annex 2 - IISS PRAGUE DEFENCE SUMMIT (8 – 10 November 2024) - Copy.pdf
Size

202KB
MD5

388ebe1c45ebdf3ce9e4631708adb49a
SHA1

77ac70b8b309d62bce551bc544279fa9e07325f0
SHA256

901d713d4d12afbcee5e33603459ebc638afd6b4e2b13c72480c90313b796a66
SHA512

1e87b788c8a0c3acf528e323b05e8c2cf8ad7233eb40304e37d059c5675d6c9731d1ace895605c61d2805836367073f9e533a8fde45e4744c4cf61efdf0d2814
SSDEEP

6144:SjljdmqTXptU8sKXCEJZHvs7nrRsj/Sk05/uc+:QjE8HJ5vqnrRsekMx+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2688	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2688	AcroRd32.exe
2688	AcroRd32.exe
2688	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\IISS Prague Defence Summit 2024\Annex 2\Annex 2 - IISS PRAGUE DEFENCE SUMMIT (8 – 10 November 2024) - Copy.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
774316a6fcad3a0f2f4043a0a4adf48f

SHA1
799f3590e4b31231f6663a0933983be8e5c2e569

SHA256
a971d09ac2e4f75152ec67b3036a5d8688f29c2044825fac116d767c46454895

SHA512
ed09c9c8a6babb4f84474b9ad4873ba6e696da3a69e7e98fe8a871b273ab92a58b5313f707cb43d9d815a1636edba83fd894865600fb83923337f561621c6eae

Download Submit