34b25daf32acd944c2184349da251c6051122a26173aded7a273c2dac60930b9

Analysis

max time kernel
105s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7.8.1.5.4 NY Marshall Tax RPTL-487Notice (Town) 20220826.pdf
Size

690KB
MD5

c2ef9c49b2a68bc3002ea7ec49e875e8
SHA1

150de46a6fdaf5eaab7176c51ff03c404cd76099
SHA256

6773fb38a3805fe0eb0e0ac310d1ba8ad81deeb10f222b99fe349ab53d00bd0f
SHA512

f49e189d5ceae77aa7e901b6f8b108c80d4a0e47d86b5c573088e91efe9c1af6f1dc3b94a610b4729ca9255faec53b4118cfdc33992921d35cfbec873cbd38a3
SSDEEP

12288:kIRRUIMYbGR9zsZH26QrvhlYqjzMIzlTGoPdP1A2oIE20of/S:PUIRGR9wZWrrvhlP/vZG0Z1AJt20eS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1428	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1428	AcroRd32.exe
1428	AcroRd32.exe
1428	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7.8.1.5.4 NY Marshall Tax RPTL-487Notice (Town) 20220826.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c25779cadccbd745809eda97bae43a07

SHA1
d0abe4905f22b91fb9aebd71e6badfbc4a25b563

SHA256
b28a7136ced70dca09c3c3d52243caba4e21c8f04186f8fef6c8fc9e7f338ef3

SHA512
5c30b1cca8ff9a17d19f620d384d276d7054e0c3d16c46f32c4fdbd44982724920af9abf6687c192bed77b775b13e6bfe1ca71f612bfb8bec57d18b8eab22649

Download Submit