c4e2b8bd59677a444d57c70c84f04620c7b02c0d213a52d24ce7ee65e52fcdbe

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UNDANGAN RAKER 1.1.pdf
Size

273KB
MD5

181ef397a48cdda3daf59ee3396a4129
SHA1

ba7fad3fd02599712a61cfa2bc11042ebcb57826
SHA256

c4e2b8bd59677a444d57c70c84f04620c7b02c0d213a52d24ce7ee65e52fcdbe
SHA512

0c6e3937c883d78d93118be42467fa1d2c7d63140efce390ade2048ba35d52bed0a0971c3bd1bb990614b42afb4e7849e4f6598f64ab80dbca3983f20f68d230
SSDEEP

6144:br4oFtdTX28M8/9CPt86xXI5laipX9bid60k3cNB1ihhPVYPCEr:br4oFtk8M8/9+tz45Aep+6vsNnkhtYdr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2652	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2652	AcroRd32.exe
2652	AcroRd32.exe
2652	AcroRd32.exe
2652	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\UNDANGAN RAKER 1.1.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7c840b41ed20cf114433066f3a67f5c1

SHA1
77e23a857c9a3c83f1630f3fc4491b894025c9ab

SHA256
342d03951f05e8789dce419b6a4bd93c6941140c04e5c4205023943490d34f85

SHA512
94bff506f15ef1341782e79c13251953742741db8acb8296732e40b1ed40173b20ebacd861d01e5b0ee3d20e1dd6bd5726533d9c9f086b81e3ac6088ca0a3fcc

Download Submit