cf5b009d36a4f45d435e3a10ac62c19fcbd161f69689589f8e9280735441da5c

Resubmissions

02-10-2024 14:18

241002-rmqaps1akp 10

02-10-2024 14:16

241002-rk413sthmc 10

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Refrence-Order#63729.pdf
Size

75KB
MD5

a0c8986f254942da6398f191ea2de509
SHA1

4e40a90768dfeff4c0cb4411a176bd7be68c9ac7
SHA256

cf5b009d36a4f45d435e3a10ac62c19fcbd161f69689589f8e9280735441da5c
SHA512

0eef50fd30c31b3c21abd04715c59126625bb9805ef377a75b0f0ef6abe0336d7e1273591455fe33bd13bc49577aa37257a7d0e664083365c2fac7d4d00565a1
SSDEEP

1536:ThWq0RfD6oBNp2XEgbyv2VCQ6zYkwvrAi2DSYbTBxQ7MOxjd/VcReDjslRvwG:VZ0RfmUNp2XEgbS2VezYkwvMxt8jxNVM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1736 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1736 AcroRd32.exe
1736 AcroRd32.exe
1736 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
1736	AcroRd32.exe

pid	process
1736	AcroRd32.exe
1736	AcroRd32.exe
1736	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Refrence-Order#63729.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9f35057705eacfccda5b917533e8213d

SHA1
e7ba195ecf7d67e63fc7a4afd7c95f3104958ed4

SHA256
b7e1d3065855252b0ab0aef3298066301179324d89b13956563841ac29a68b54

SHA512
25a3499cf4da68738901c756f4a211ffa6f89ce7ff774186150a2315e37785e56721330178e28522705517b06dad6c693d8d4d4010adbe19b0510e692be46612

Download Submit