30263649fa9032042bd4f1828fd41e6dc096be790c60c886741b4ae0fb86bd22

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-10-2024 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Data/Documentation/SELENIUM CONFIGS HANDBOOK.pdf
Size

167KB
MD5

4be53fa513da244f73f53d4304a24ca4
SHA1

5097d76833fb29fdf1bdd0eaddd37692b98928d1
SHA256

50b2c26d365832ae317e15cffdda06febb0b3a7077fbcebbf1fa96c5beff4965
SHA512

34e20adc33fefaf5bfbcd477eccc0db65e8487822a1c4f0bb2de68bdc8dfe6632a542b524de0bacc71a1b2564efcefcc548b1ceb69e491438f553e1347988829
SSDEEP

3072:2bC9ASTWakWCy0d07BCRBCdP85v/IHsNxgtFM5MSUT+r3NK+YemCMqZMkWQ1w:EmASRkWZa8+v/IHsjIu6SUirdK+aqGkc

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3048	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3048	AcroRd32.exe
3048	AcroRd32.exe
3048	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Data\Documentation\SELENIUM CONFIGS HANDBOOK.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b3a1e10fa61727c519fb959cd92761fe

SHA1
9f92462ed570c24a19ebaa494e00f55b7e2dc60c

SHA256
ff601c9557ff3a1a19bfec09e4c8809801963b57a8b3c43092323939ceb70c2d

SHA512
44f589853fe13102c906ac3a0686a5eb2174a959de1278f50e74d888b8341866debd20c1f6f00a09a149503728771c6a316a32418ada8a3d16a118cbf6e6b983

Download Submit