db5d7f84baf1b1e37383273814398ada75b8d1b0b1b4ec9227776f090cbc5870

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Paste 4.4.0 [MacKed]/Paste.app/Contents/Resources/Assets.pdf
Size

3.5MB
MD5

ca5d0fced4d6cd6618200ed358ccbdb8
SHA1

a9932ec80ee08508657590fd096efe4fdf0730d6
SHA256

0e011f651eb313c7c05a66d650de81c0849b894345b5a56ab83ce6956473252f
SHA512

f7a28fd9149ba1f2e2649c01dd3c3265128e895bae3ec5f7857f198e2a59bea6a8190449439867416a9f5c782e5776d423c6137f7bf4ee15641c142e03ada275
SSDEEP

98304:Pu/I8p1EDtdBFy8kuJ2bkcyt30qXrZqwbffuX/:PW1kDi8kuJKytfpbffu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2384	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2384	AcroRd32.exe
2384	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Paste 4.4.0 [MacKed]\Paste.app\Contents\Resources\Assets.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c9987b39fe14339182f9788bc9bf31e6

SHA1
ccf5d68fbb197f3d7b863f319feb8eccb97aa2b5

SHA256
6b6ffac3d9b3a42acf3fa7d8e4b4a5dfbe0afcfd25cd3bd4204120ffbd6a7027

SHA512
f4ca62b5f45817871f76533b45b29612510f114513ca9f75543ab77da2652757c2267a834fae947e37bda04dfa113917fe90893212d83861b32afd17114d3449

Download Submit