aa7fa8c6a6e1a2cfaf36a8866ccd95024d4bbd392457e41622c963f4e144d007

Resubmissions

14-10-2024 13:16

241014-qhrsasxble 3

14-10-2024 13:10

241014-qewbba1enp 3

14-10-2024 13:10

241014-qeg4pawhrh 1

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CONTOH PUISI ARAB.pdf
Size

75KB
MD5

40ee97dc44cbe11a4d1a831822a1dcbb
SHA1

bb10270c4c8dd0a15875facf546dc0b2286cb9d4
SHA256

aa7fa8c6a6e1a2cfaf36a8866ccd95024d4bbd392457e41622c963f4e144d007
SHA512

4dd9fb1da40849d8403aa9c5bf684b24d85cd6639759ff76bff976b2795d5d5b01734596a1d8eb4aa1183605465ef40d1a34c697eddaf3bba0cd4395f6d6c965
SSDEEP

1536:NfjXTZwjD3nsaD5YsHpuxrm5vOMn8mHoPorN:VjXFw5OUuxGvomHoPQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2068	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2068	AcroRd32.exe
2068	AcroRd32.exe
2068	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CONTOH PUISI ARAB.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d05916e8320ebd55f574b8869fe21780

SHA1
059c630a8f7e71aef7dadfbebfc420e3ae7276a5

SHA256
6114e1a5d446b83fc70e2486a2d537c66e8129ac6f6c28b44df5d8296b2312ee

SHA512
1573c6b512f509563000d62279766be1f954c3bb29e79dabdd801bc03c667cc55934100ac715f44f18b12a214d7c1886253740640b9aa4d3ae0e4c262fd56be0

Download Submit