67653dffdd7e26b20e8c6a96ee6c61365aeb351e1931cb8169c8546e756c53c6

Analysis

max time kernel
39s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CSM_RB1.pdf
Size

200KB
MD5

a20c924cba4eec7f4be27e6eee945171
SHA1

2b37cfb298a6d540b1df1c5b06d1f06ef382c39d
SHA256

67653dffdd7e26b20e8c6a96ee6c61365aeb351e1931cb8169c8546e756c53c6
SHA512

4405bd9b0f053e43e5928755e9ec16e0a5150694a11584f1a85351b1c2c0247e4e81b162c20e17f7d95717fd43dbf62fd4a785fa1c019544fbf241e0c76b89be
SSDEEP

3072:kvp3NiMMG2yuEWTiU9iFVIRu4vQ5kZjNGj5svy5KdYafPd6aUCJ6s6be+P3fMXWx:ehudJsF47BNGZ/qPd6aybtPUX+iwAQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2568	AcroRd32.exe
2568	AcroRd32.exe
2568	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CSM_RB1.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
afc52be448509eb423bf24edceb98d6f

SHA1
dc150d57c7677cd0d06cd9dc49f2ac9f00b24e1c

SHA256
e2c146f9e028709810b68b9a563941ac76e8176ce2601875e8f507a81a127af7

SHA512
3a8793c3a1cce89173545058856603f5a2416c587fdd51de603e250d515a0a2969097aa25981b85fb060bb87c690f4276c21b567d3f772ebe6656c46dc19e7cd

Download Submit