9dc305f1a60f776006b2bafa60caeb9c43665c2b436b1cb30deff1df9d8f4d7b

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-09-2024 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rename_me.pdf
Size

130.0MB
MD5

f158d3387c6e2cb1b482f7b7abee7e20
SHA1

9aadedb8049339dd027a45bc733caa1f6f3dc7a9
SHA256

c052369f476b624913e8aec1a3ba729d30b5d5f145c4c5c58d64f7d09cfa54b5
SHA512

93e92533c93d966007eaf6fb35772e362326eb8bd321f1db28cfa98943277589a393081157a8832f162776127eb91974e3f93a2ea3475e936db1f228973bc40e
SSDEEP

3145728:96lH+byk0ZggBznCh2HCea5bQ92NmDVr9XqnZGWp:

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

AcroRd32.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid	Process
2176	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exe

pid	Process
2176	AcroRd32.exe
2176	AcroRd32.exe
2176	AcroRd32.exe
2176	AcroRd32.exe
2176	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\rename_me.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0404a2feadf41b56ecf34043d083fb0d

SHA1
eae7b25a1fa0a5bb018d656034cd78b671596de3

SHA256
e9269cd7eaf5e4b0aaac0a231e37635afad953f14181f423e31e51ca59680be5

SHA512
242cb24baf79ca20115a148dc6d917cf58f5b53092c2b37fe319d762af19c8159081c2e395f32d769ee5c0ae6d06b8767594f9a2dbdb8bc7ac36854a89fb915f

Download Submit