3e38cf5ec0c70a163d1f49fc14a0d74debde7067f852ede160e8090feec529e8

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rename_me.pdf
Size

130.0MB
MD5

f158d3387c6e2cb1b482f7b7abee7e20
SHA1

9aadedb8049339dd027a45bc733caa1f6f3dc7a9
SHA256

c052369f476b624913e8aec1a3ba729d30b5d5f145c4c5c58d64f7d09cfa54b5
SHA512

93e92533c93d966007eaf6fb35772e362326eb8bd321f1db28cfa98943277589a393081157a8832f162776127eb91974e3f93a2ea3475e936db1f228973bc40e
SSDEEP

3145728:96lH+byk0ZggBznCh2HCea5bQ92NmDVr9XqnZGWp:

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

3012 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

3012 AcroRd32.exe
3012 AcroRd32.exe
3012 AcroRd32.exe
3012 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
3012	AcroRd32.exe

pid	process
3012	AcroRd32.exe
3012	AcroRd32.exe
3012	AcroRd32.exe
3012	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\rename_me.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
14247fe4a879e1e42df53d1463dc8d7e

SHA1
0f70e823f455b3ae6ac685cb6aa01ed2893350c9

SHA256
ce4b7da88c9b9837873c57c5014814e400129edb87cab07967ec59c2cd77688c

SHA512
6b31c1dbcb4be8710aae08aa94d3598d5b5a0baac6b67d2b5abd0a70a296c98fd397d7225fd5b85d1b9bf396b736d053b728f7d6fbdee0b9b8be52ba259bea23

Download Submit