f0a8e6bfb2df4fde05ad87e36076e035156527790b8a239e420a8321d39e2c07

Analysis

max time kernel
122s
max time network
136s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Copyright Infringement Notice - Noontalk Media/rename_me.pdf
Size

130.0MB
MD5

f158d3387c6e2cb1b482f7b7abee7e20
SHA1

9aadedb8049339dd027a45bc733caa1f6f3dc7a9
SHA256

c052369f476b624913e8aec1a3ba729d30b5d5f145c4c5c58d64f7d09cfa54b5
SHA512

93e92533c93d966007eaf6fb35772e362326eb8bd321f1db28cfa98943277589a393081157a8832f162776127eb91974e3f93a2ea3475e936db1f228973bc40e
SSDEEP

3145728:96lH+byk0ZggBznCh2HCea5bQ92NmDVr9XqnZGWp:

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2008 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

2008 AcroRd32.exe
2008 AcroRd32.exe
2008 AcroRd32.exe
2008 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2008	AcroRd32.exe

pid	process
2008	AcroRd32.exe
2008	AcroRd32.exe
2008	AcroRd32.exe
2008	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Copyright Infringement Notice - Noontalk Media\rename_me.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
179dc2a8174ba7e41ea1d261017a02f0

SHA1
4f95295ce69c29f90ac04f362b31dfd071e9b695

SHA256
dcb58484dedf04b70d9fa7bc7dd75a575d8c3c495cd25846f7b60629a8914d76

SHA512
4bd351b5c9d3adc920deeefd1576649269f9617f1d89b0567810ed5ea813219ae0ccbb9c87c9b395b55aab86dfb15975329e69b3ccb07b4f1c9f75096c2b0213

Download Submit