9414d0cec9f5df6c254c3701fe4da6d262684b8082a6374013364fc13de5db8a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Davis Melatonin Sample COA.pdf
Size

384KB
MD5

e49795c3e16cfc641729d7963352869a
SHA1

4e3233a6a625d7fe3de70173a9598b8c0428ebbc
SHA256

b9f2c424d446327ab10ca571755fc1ae4f375f05abe633de486ab796a7bacc9c
SHA512

64e98d207c92a2f316ed812f75661990fb81f4553bb6c215b42c23cd26b638891cb3d74d12587660cf3009a31e87c4f31fc44624eae04c668ae373d55eb01a11
SSDEEP

6144:BLmOR7/nQzTQZln3WC0TBuxEK1YZmlIQfmYC8qWFF7lKs7a6X2:BXcQDn3wuxlWZmlIQf48VFZV2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2008	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2008	AcroRd32.exe
2008	AcroRd32.exe
2008	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Davis Melatonin Sample COA.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f923de962abae5b84108ea2035bb2366

SHA1
cc8e4312cd13be4e3d4b08eec8ed90173b8427f5

SHA256
2d91c9fd8d5f6dd0001403cb18dec267b9c3056032daf6f507c8051d0bba36cd

SHA512
6e38c43059f6f8a4c2d1f4d9014d844683a022e737d55b3c94de506a9a79f2fe437469c45f5f8e7aa17cbad561aaff88ce840df6273d32b365366f37b96444fc

Download Submit