ee6bd635882b8671a4dc5f087d23b486c8ec8a2cef029ebc7b54bed4f87cb87a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHL DOCUMENTS.pdf
Size

209KB
MD5

61b78af88b7a11495ce31f30e85b534b
SHA1

a0719fd5cfef8f5e0218478144af0a9adf12d093
SHA256

e940aeb482ec2ce42490dbbfcae479653f3faed641e6240d5d215da66dd07611
SHA512

0578750f5c06cc208c9c21680d6ae206cb46a3023dc90dcc3f7b8e0fe2303cb17fcb2b0d101e49c975229a6ea82cf796790ed7da98a22f33db9577010a4cdd94
SSDEEP

3072:eRU/Xl9OdKwPk77hXigudfY241JuphB+WTPL8912eS4Ay1cGtZhJGYVu2NA8cH:bKk7Bsfw1SB+2PLE2jyNZhJt8L

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1968	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1968	AcroRd32.exe
1968	AcroRd32.exe
1968	AcroRd32.exe
1968	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DHL DOCUMENTS.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7e5545c1afdb93a7ea4af47b3a994733

SHA1
cd25cfcd6bc53b8621eff085e8eb8a10c4d4ef14

SHA256
e4a3e77bb02be169555d141bf9b5346dc05c5087641a55991054fe5f190440cb

SHA512
f6c5906cc8229ccffcfdf22c544a8c494eef9cb2de8c030272e98d29994c3e33f3e511ea67b98ff4ac07c94a287d527967cec76a6192265f115b9ed729501d3f

Download Submit