2f16279e427a4195d134a8f4eaa2bbdb1187efa912e90947baa157097d89bdf6

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
23-10-2024 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KTR Bilgisayar Yönetimi/VirusTotal/VirusTotal.pdf
Size

149KB
MD5

b220c3823391000a26475839eb7a832b
SHA1

e6fe6bffeb5ff209ee219bde2e870599e2fc0b6b
SHA256

cea8433eb011f56b5c17a5671fda00b95a8fa2ff4c9784b45a83d7bfd321f3bb
SHA512

f08bcf95c6ef4ff8d5d2af5208a26727a8f0e41b9d6fb1034a812757b999e406a60b0f366e03aa958f12a22111e407c49d38f466cf7ec7233afdfa8341ef5d86
SSDEEP

1536:HBb+nqKSDZTpShNpsFK6ZnjaTzHvSpFVTNi6neqtR+IIpjto/ZH:hSmDSdssUjaTzHSD1VHgjOp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2632 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2632 AcroRd32.exe
2632 AcroRd32.exe
2632 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2632	AcroRd32.exe

pid	process
2632	AcroRd32.exe
2632	AcroRd32.exe
2632	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\KTR Bilgisayar Yönetimi\VirusTotal\VirusTotal.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7bb492d3efbe2e923b174de745286ae9

SHA1
3dd9096ba8582cec4c0e9b990f534ae24cdf2ffe

SHA256
cf3b4cfad907af0075ada170f210d51001e685aee8e425103c9d5713a2bc1ded

SHA512
46ec8ace29a4513b0248584965c63d8664f639b40fbc0cdc230ec7c4414bc3ac6d566d31cb7c405266f6dd2c9485c5cedefd621dad974d719137fcea2beb3834

Download Submit