Analysis
-
max time kernel
119s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09/10/2024, 20:47
General
-
Target
AcroRdrDCx642400320112_en_US.exe
-
Size
443.6MB
-
MD5
5c5dd077a31f23873dbe25ab6ef34933
-
SHA1
0ed71a3efa6df98f5cc6bba9fa4f7c80d5d78c2f
-
SHA256
42b5d414c5ff65e662998a92cf54179df694e5ee88793531fee4ee32e70d41fb
-
SHA512
e5b60089ade6c6acc1d147c15357e2b429b1fa19354fc757df0ff85b46435b79046e53b8b24e79d163743fe3f93229687d844b527ae7c8ad3c63732fa83f0acb
-
SSDEEP
6291456:IzwRUHohZ0VHvxI0/r8tSzMXPhHm9sson9HFMAYFbL3/sbCQaML56XLTIzY3ywu8:WohZTAI/J9JM33/sbza9XfAY3y6wEyt+
Malware Config
Signatures
-
Drops file in Program Files directory 22 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AcroRdrDCx642400320112_en_US.exe"C:\Users\Admin\AppData\Local\Temp\AcroRdrDCx642400320112_en_US.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe"C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe" /msi DISABLE_CACHE=12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5c28672dec79bafe8e8f1ffbb5323fd83
SHA168730beceadce609f731bf7c18e77aaff220e29a
SHA256dbe36a4b065a8c5aa52b066a837c06044d373d7f81d0ee7c2e313de460bde3e5
SHA5128cb3b16d431cf7776624289df3fd1c6bf86ab4587a1f4c2dab1dd207e66a69520390968d3f2f37598e918160b57fb87762279da0a40670bace06f6be86f40677
-
Filesize
269B
MD583361d9265a137aad732af43c5f23ce1
SHA173e0e6c72aebd3ced38d93a3c0200edcf3d5445e
SHA256e22fdac7c9d9fcd4aa8186731aea26ad5e47228c48116924ad1d106f6a17a5ef
SHA512215c4f3ad7fc74eb21eefd75db280d16568f8adabefe87d5eef117267d0d80e2a721d66f59bada183d6a538b4d73cb80576dbcf86987ee057faf90fda5b3ddd4
-
Filesize
636KB
MD5228037b00acb7cf3c059d51cf0e0728d
SHA114590e917d68375d8e4f33d6a984ad82be0bbcf9
SHA2568a9f151e112fafd0fdba94941b1926273f9c9cd9700217765f0064677f5d417b
SHA512c3042b22cc77db81b97685a66eacd25872b39195dc3c34f8695b2c16646a526c55718a4298df4043dda250555a04a6c53c4add5796a3430f64d782f20750f9ac