145b71a45339f471b845ceace305f62421c46ec7ad84254f316f12de16c17d80

Analysis

max time kernel
1613s
max time network
1559s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Distribution Agreement_Review-(Acerinox) 10_29_30 -September 12, 2024-WRXEQFEUMA.pdf
Size

82KB
MD5

a1f54984246bc84e24977b27d4485319
SHA1

572fb60636f9369f5c4b9b0b478c09175cddc041
SHA256

145b71a45339f471b845ceace305f62421c46ec7ad84254f316f12de16c17d80
SHA512

af2ee6e04f6ba2f86250a76510580fbf45f2d62c194c5f7842d51e31749182548755f5ad0e2ffc401fbb774d363e8777d000df8387aa945205ec3545d9ad75f5
SSDEEP

1536:87DxFhy5d6gww6mFmJ1CiQlZzkc31ZmbrM+my9nw5:87DxFhSz6RbVQTZZS5Vy

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2096	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2096	AcroRd32.exe
2096	AcroRd32.exe
2096	AcroRd32.exe
2096	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Distribution Agreement_Review-(Acerinox) 10_29_30 -September 12, 2024-WRXEQFEUMA.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
70bc7662f10ae52d665a5a92acb2ddf5

SHA1
9a0552c52b40c4f76d8412d6651c4ece1d24d295

SHA256
e5c39bf87afd153db94d14467e9e7c2d9ec0446288800f388109bcb7bae292a9

SHA512
fa07cce0132227a70a7c59bf08a98aff6122d249be549ed2676ac5a039cb7f4a2e4f7d82758462679f43141028604d536d4718babd6db7b3d1c660351428f2a2

Download Submit