e77a6658a160c60bbbfb226f5418b637edde1a1066c9f43d61a40034b7fccf5d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Платежное Поручение вiд 10.09.2024р.pdf
Size

80KB
MD5

86c918eabe06de61362d1ee17005357e
SHA1

c2ccb5ae62e770b61c329048d0efea5b12c7924d
SHA256

5ed2bca9e9209be4227d481cae9a774162379e23f643f11c8f68da6a9df7b026
SHA512

e583251a10489daa928b0a690032a01477113276d72e8be8ede745d5d4eea49d800a90088644292c709ad1410274066d94978ebc66f4da0db7ef78a679c2e8c9
SSDEEP

1536:fzbG8WF0csb6AuEbJ/fOT8oRPDpVl9MZu4HUjFvP1TsXxPVBqBS8g1N72Rqs:XoHsOAl/WTJNfs4q4/TsXxbqg1Ngqs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2676	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Платежное Поручение вiд 10.09.2024р.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
70a73b6c827ba97c09dfa3883a2f7ea8

SHA1
7e0f8952182cec555295a366af25297df13a63e9

SHA256
6c917b2ba71d6dbad41b8b02ca55553d2043115a2587361fae5a813cd880f724

SHA512
18cf7af67924c68ba287eb6673991700926d3ad3edc9f3bade3912407f96801ce317d64ac76df0aaf01549bdab2d4565c3ce6d276014b12618e58698e14c46ca

Download Submit