4e57cfeec782e7e9dd90163dc3490285d8948e75db9eb95f7208f36897d737fc

Analysis

max time kernel
98s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LIBROS/Information Technology Project Management by Kathy Schwalbe.pdf
Size 9.1MB
Sample240913-wph2ma1dra
SHA256 6f43ec3fc6970d25ffdf31f2a570335972b31d3a67ba9ce60719588f41d2e9cd
MD5 416b0de0a6a1a12a2b615cf6796c0bfd
SHA1 990a5ca37fd1588c51dfd20734c493d199334263
SHA512 d400a2fb0e54faab9b9796011d0a2866e794cefd16f776d4f2c238a22956eae5b5579aa299f8c25edc31addacab8bfca908730a4255a4d276372f55a543a7769
SSDEEP 196608:kj/earAThN5UNaV4JkdukltLeFqUXPC6x2PBPFAn:k7AThrsJGRtlRJdAn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1288	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1288	AcroRd32.exe
1288	AcroRd32.exe
1288	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\LIBROS\Information Technology Project Management by Kathy Schwalbe.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 ccaad5eb79e5308cc0a529f5850d0be7aea649c2d557f223ff5419a94350c8ee
MD5 9c3f27422d69a19b2e65900cbd5bc54d
SHA1 ab096d9215d42294a0d47fcc69ddeba0eafefbac
SHA512 cf2bf5a630defca4e41ccf2f61d5618de807e857145a898fc629f96754e67fae2e726626ce6e3e9d9018ea92514c11680044dce4567c53bb2e67ca877a18987f
MD5 SHA1 SHA512

Submit Download