cf5b009d36a4f45d435e3a10ac62c19fcbd161f69689589f8e9280735441da5c

Resubmissions

02/10/2024, 14:18

241002-rmqaps1akp10

02/10/2024, 14:16

241002-rk413sthmc10

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Refrence-Order#63729.pdf
Size 75KB
Sample241002-rmqaps1akp
SHA256 cf5b009d36a4f45d435e3a10ac62c19fcbd161f69689589f8e9280735441da5c
MD5 a0c8986f254942da6398f191ea2de509
SHA1 4e40a90768dfeff4c0cb4411a176bd7be68c9ac7
SHA512 0eef50fd30c31b3c21abd04715c59126625bb9805ef377a75b0f0ef6abe0336d7e1273591455fe33bd13bc49577aa37257a7d0e664083365c2fac7d4d00565a1
SSDEEP 1536:ThWq0RfD6oBNp2XEgbyv2VCQ6zYkwvrAi2DSYbTBxQ7MOxjd/VcReDjslRvwG:VZ0RfmUNp2XEgbS2VezYkwvMxt8jxNVM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1736	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1736	AcroRd32.exe
1736	AcroRd32.exe
1736	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Refrence-Order#63729.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 b7e1d3065855252b0ab0aef3298066301179324d89b13956563841ac29a68b54
MD5 9f35057705eacfccda5b917533e8213d
SHA1 e7ba195ecf7d67e63fc7a4afd7c95f3104958ed4
SHA512 25a3499cf4da68738901c756f4a211ffa6f89ce7ff774186150a2315e37785e56721330178e28522705517b06dad6c693d8d4d4010adbe19b0510e692be46612
MD5 SHA1 SHA512

Submit Download