3e38cf5ec0c70a163d1f49fc14a0d74debde7067f852ede160e8090feec529e8

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rename_me.pdf
Size

130.0MB
MD5

f158d3387c6e2cb1b482f7b7abee7e20
SHA1

9aadedb8049339dd027a45bc733caa1f6f3dc7a9
SHA256

c052369f476b624913e8aec1a3ba729d30b5d5f145c4c5c58d64f7d09cfa54b5
SHA512

93e92533c93d966007eaf6fb35772e362326eb8bd321f1db28cfa98943277589a393081157a8832f162776127eb91974e3f93a2ea3475e936db1f228973bc40e
SSDEEP

3145728:96lH+byk0ZggBznCh2HCea5bQ92NmDVr9XqnZGWp:

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

AcroRd32.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid	Process
1444	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid	Process
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe
1444	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\rename_me.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
59271be8d3c320fc8a9461d09e7ec80f

SHA1
005fe5904e616b3d71f721fb2fe966fe62e4b8a8

SHA256
a55e1267952fc8008174f327337de1991896fda629382bb21333c24c482709c5

SHA512
71866829121e84e6958aba109f108965de41ef8624ffb9c93d014b472293873d480466944990b3e7e3bd5e4cad9ed7a606c3c7b902e96b50131621f0a1150bde

Download Submit