Analysis
-
max time kernel
95s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
30-10-2024 01:21
Behavioral task
behavioral1
Sample
1503000793 Torque Wrench expires on 2025.10.21 (1).pdf
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
1503000793 Torque Wrench expires on 2025.10.21 (1).pdf
Resource
win10v2004-20241007-en
General
-
Target
1503000793 Torque Wrench expires on 2025.10.21 (1).pdf
-
Size
3.6MB
-
MD5
0054b7e745f355ef4c6bfcb5bec45e5b
-
SHA1
94391cf5f355c30bcbdd0ac824b43471e31d674d
-
SHA256
a4b96b46f0cf3a485cddab2cb667037592359d25556e4eeb2cecd7247d823c84
-
SHA512
cdcf960ecad175ec904dd3215584ba0804e7cecbc4a14d9871fcf7f42cbd9d83cde7e434049e3cc1be28e750cd518d096c95e7debb157efba4c424c314c45076
-
SSDEEP
98304:24FTxU4p4FMH7U4p4FMHpU4p4FMH2U4p4FMHDU4p4FMHqKsh:BEMSMcM1MaM2h
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2220 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2220 AcroRd32.exe 2220 AcroRd32.exe 2220 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1503000793 Torque Wrench expires on 2025.10.21 (1).pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5771c6a447d35cb3efb020f3a8d7f973e
SHA1da39c885411504b5bdc794d6e5deb26829a66e9b
SHA2564d3b44ef2c8ce6d3959bc35252f7474cc5f3b8e3c57641ec14b01f1a1c0307ff
SHA51222bb27f4e7f391eb25850c27ff681624917704ec93e8d8de41cdc7ae0124dff0fbe9f7a3a42a3ff96fab5f899aac2f1fa7fc78b612a133d8a83a8a0409ec8324