beb2c2df63dea943bcc4a71d0509b187f0517436d5e6d50a60c2a104521bf04e

Resubmissions

09/10/2024, 04:00

241009-eknymstflj 5

09/10/2024, 03:58

241009-ejvd2axgrg 3

Analysis

max time kernel
51s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Destaque-ESG-2024-REGULAMENTO.pdf
Size

59KB
MD5

4cd45985fad53ed87dd650912853311a
SHA1

0c0d34f6437243bb9a69412c341299d91dd4d4d2
SHA256

beb2c2df63dea943bcc4a71d0509b187f0517436d5e6d50a60c2a104521bf04e
SHA512

28a766d7b71ce91e5094d89eb7f4e28480325f1d064b10e1ab93ddbe2bdb19c9479087d7dc8eae070986a5a180ccefdf93460d2edef00d3e3532e529fe9aa40f
SSDEEP

1536:ZOLyjqilNPi2kXubH84D3tEgDjiyQLo9/h8rgKPEH:8LrilNPweLVDOg/i0h8rg1H

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2768	AcroRd32.exe
2768	AcroRd32.exe
2768	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Destaque-ESG-2024-REGULAMENTO.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e912f14f6fc5f06414e9836241617efa

SHA1
78cdb5bc2e32235e3f1d8eb9fa3b550cfcd25e4e

SHA256
7793cabcf7947253e29b9531ce3bcf70057b79f7fe0b96490c6b00c7f5c71647

SHA512
d29e2e1010401e38b27bf82afbe33ed22a4b3567829179750a6618dc1e2218aef1247add3f2dfc3afc5ea0d8e7639da22053a8ca021962dd16b1a7cf87e3b631

Download Submit