4e57cfeec782e7e9dd90163dc3490285d8948e75db9eb95f7208f36897d737fc

Analysis

max time kernel
98s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LIBROS/Information Technology Project Management by Kathy Schwalbe.pdf
Size

9.1MB
MD5

416b0de0a6a1a12a2b615cf6796c0bfd
SHA1

990a5ca37fd1588c51dfd20734c493d199334263
SHA256

6f43ec3fc6970d25ffdf31f2a570335972b31d3a67ba9ce60719588f41d2e9cd
SHA512

d400a2fb0e54faab9b9796011d0a2866e794cefd16f776d4f2c238a22956eae5b5579aa299f8c25edc31addacab8bfca908730a4255a4d276372f55a543a7769
SSDEEP

196608:kj/earAThN5UNaV4JkdukltLeFqUXPC6x2PBPFAn:k7AThrsJGRtlRJdAn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1288	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1288	AcroRd32.exe
1288	AcroRd32.exe
1288	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\LIBROS\Information Technology Project Management by Kathy Schwalbe.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9c3f27422d69a19b2e65900cbd5bc54d

SHA1
ab096d9215d42294a0d47fcc69ddeba0eafefbac

SHA256
ccaad5eb79e5308cc0a529f5850d0be7aea649c2d557f223ff5419a94350c8ee

SHA512
cf2bf5a630defca4e41ccf2f61d5618de807e857145a898fc629f96754e67fae2e726626ce6e3e9d9018ea92514c11680044dce4567c53bb2e67ca877a18987f

Download Submit