b4bfba362d1d68de5176add660027807c782d16aaa5ba899a53d900296041fd5

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

W2.pdf
Size

36.1MB
MD5

2711a1512a4b86f0745885506d603397
SHA1

31d665fe7bca6509824ed12904af18494490e27a
SHA256

418f7a063559b628c394b4d3d47148e1226697c55fe5d478706ef96d122a9961
SHA512

ea465376e333c0c4a481d9937256bc70051bdba5786a09798fec169cb281b01e566f04ab1fd2438462ca10e3dd5ee71c7b4fd8789661c31ed877ebc4dc4d9361
SSDEEP

786432:94rbnl4Qbn+40bny4Rbn04ubng4dbnB4sbnn4rbnh4nbnH4a:94/l4G+4ay4d048g4pB4Cn4/h4bH4a

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1600	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1600	AcroRd32.exe
1600	AcroRd32.exe
1600	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\W2.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d0bb3e18fefcfd85699c33c9aaa7020e

SHA1
1c8292e05cb4292118a6c4aa95446d68f282c5b1

SHA256
31743b30fe289d37edcca51b83b8783dd50042a604a3dba41b2be8eb5c5dd80a

SHA512
8ca29281bce4da4a84ea8d18fbbfa8db5f4d38f6533c6f7d8c79dc69e2f7c6663eba16b6cfffc780cc1789e4ce77bd5f151ae5fa728cfe97c5ff49e670ce6a4a

Download Submit