ba7e8154b1196ca0d24ff2d8aff5ea745d929d98bc64aba53f0a75d744ed40b7

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Please_Sign_joy.mondragon_nBdKH.pdf
Size

27KB
MD5

a14f52bcd320b37ee4f9565d6f17dcda
SHA1

6f38236e93eb7c5fad9c0d38fb66d95a8dcc9453
SHA256

ba7e8154b1196ca0d24ff2d8aff5ea745d929d98bc64aba53f0a75d744ed40b7
SHA512

26e9d1a8d26d88119554c4f1030f95ec049a63a865673458224906c72d482b848a22a5bbd7aac80fd0488e6bb060dd9d5526fe882ddd4f353db22c34e8f76e20
SSDEEP

768:1JxyM1ONgTT+glsfqD2OpOab4q5qolvUD:tgNgCSVQab4q5llk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3068	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3068	AcroRd32.exe
3068	AcroRd32.exe
3068	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Please_Sign_joy.mondragon_nBdKH.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fb718bf0a945400cf67c252b7dd57f2b

SHA1
f9b5b135d6f62f4f010390238f36d14210750a32

SHA256
13adb0a1acd4d515ec20b90fd574cb424cc1286a75fa6a49366e85bbcd0432c3

SHA512
04892ffc7476dd2c9870730ff1acd2581b1c7eef7b41d7954560a2baaaf5febe461b6a79b207de8b751607ca28e42f9683d23035ef120170a38217197fdaa1a6

Download Submit