34b25daf32acd944c2184349da251c6051122a26173aded7a273c2dac60930b9

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7.8.1.5.5 NY Marshall Tax RPTL-487Response (SchoolDistrict) 20221110.pdf
Size

99KB
MD5

20cec320212ddb069dbaae0ec6efb654
SHA1

64f3264746af1256ad88548e846648c31631881a
SHA256

03f0f1dc3bba50b098e23ee43a12b04f6fee9bdf95fc7693e24b6a885f55af17
SHA512

e3552a31abdb94e2d3d6b61e65c06e6e572577e81b8cd884057820218886209313f53c87ad59244b406f2a3d465963cdece03ac17628e9154f103f6bdc3644bc
SSDEEP

1536:+Q1XCBBwxdlSWwirn3jnbsKdgyqNcyiAGzX4xcXCwTDQVlT2MBQGkNGF4DhWLzsi:x1XCBuRuW3jYKGyfjgcXhwLT2iQFAs9Y

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2308	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2308	AcroRd32.exe
2308	AcroRd32.exe
2308	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7.8.1.5.5 NY Marshall Tax RPTL-487Response (SchoolDistrict) 20221110.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c74a31d63b08bddce0931a0268243155

SHA1
97f8da9743fa33c72dd2b5320bd35d0b1fb8a5dd

SHA256
43d2f8968cee302379ccd3cf86965fe80fc3ba13735c7d99d36b22aa4236d116

SHA512
2539a03990d00dcedb188d3e0f3206c1ba19cf9c6705a4170eeffa00388a3066571516082f94fa3c0a41b9675a65b08683e5ac56be9d49faf7853991622de442

Download Submit