34b25daf32acd944c2184349da251c6051122a26173aded7a273c2dac60930b9

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7.8.1.5.3 NY Marshall Tax RPTL-487Notice (SchoolDistrict) 20220826.pdf
Size

688KB
MD5

eb9fe733cd0c2090c3f45322941e6335
SHA1

d37aa0df6988f8f11c9bc72bd3ed866870a1d19b
SHA256

684d1032f72464ed66e392ef24ad482962573462d17ce98505142ea42c7d6ffb
SHA512

75811786cd754e0485d184e5d50a2d1eb41f570c58dd7e365338c7ac4b43b3fe1f886a2111e379a1f989de44d11c54a70b48fe77541b5468ab141b978fc188c2
SSDEEP

12288:BDdxwjRjGR9zsZH26QrvhlYqjzMIAlTSoPdP1A2oIE20ofgU:hPGRjGR9wZWrrvhlP/MZS0Z1AJt20/U

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1956	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7.8.1.5.3 NY Marshall Tax RPTL-487Notice (SchoolDistrict) 20220826.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5c734a60795e1938e974052522bc0701

SHA1
5cee53d3c869995879c58d2d2d661416e478dc9a

SHA256
dba3c4517018b98855f7a8d0ccafd26c573cdb85a918fce4b05fed1217e1afbd

SHA512
2908ade72cf13cb5e932dbcfb5e394e9324abe237c3095cb695d5fef71b73d4df0440b08701ea1d562920b989ef4c905b2d620d323cc67a34ff8b0be54513c5f

Download Submit