0837a53e08c8a9a2944bbfc2c56def0583dbb94010f766fff7c27ab3ec763a5f

Analysis

max time kernel
113s
max time network
15s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

STANCHART_1010000006291002_INR_01161072M0VI0_MNY_1_17092024_10004j.pdf
Size

328KB
MD5

373b777ee4b228e30294472c4b93e18b
SHA1

6eec2b4d357bcff346848f4d63f570e864af3fad
SHA256

0837a53e08c8a9a2944bbfc2c56def0583dbb94010f766fff7c27ab3ec763a5f
SHA512

6df47c3c29535effa3f524d6e6a9c7b6301508930d744a8607e1bf0dfc96862c299e9743eff4225b8a3a04106dcf28f40209f185f25875a037e7a553296dbb60
SSDEEP

6144:u5Yo4W+Sgmit/pvyrOCmp9xuyZhiDbDMgnf7vDwE7abg3gBXpQMTJOLchPXq+s:u55EbXHPiDbDhwIkXpQIOLchS+s

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1288	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1288	AcroRd32.exe
1288	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\STANCHART_1010000006291002_INR_01161072M0VI0_MNY_1_17092024_10004j.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6e857938007fb52e804b232af5d69dc1

SHA1
9f9f33841e4ac739f831285f9e25aff1d568dc78

SHA256
92a3d0e0aa899907a1229927a7a267324429da4496e5063f4f606979c0676424

SHA512
f3b93a6b89cb27408041e88448415546f518840e7962791dbb72037f15e98acbae4987df021b37109ac8b24138eb6d18f6397dfaf534d92fc936664005a300f0

Download Submit
memory/1288-0-0x00000000010F0000-0x0000000001166000-memory.dmp

Filesize
472KB

Download