9b5b6d43994986218f138e5d9cfd824ebeb594f44cbdf6733cc63d0933bddc08

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/11/2024, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
植物大战僵尸杂交版v2.6.1/【常见问题】杂交版指南.pdf
Size 3.4MB
Sample241109-e4dl1sxjbx
SHA256 b4fe9353663babb448789414a11aff7cfebd88e8132b470370d1f7a73d8f16f1
MD5 0a42394102bd0974aad056d8e070ca30
SHA1 1385324aecdfee73570cd9be3eef4671e91673f6
SHA512 3a05119dd225a74ac0ade3de872199b0dc68513ff4f1bb9d9b337498ccf4a503c69c0a5df52d1725e5040951e82313ee16edce9ec22ea9beebaa20b0c4f0c79b
SSDEEP 49152:K2dqhpdjLbJB26h3OJ+Zz6T9JiTfyj7Gnl/uGIZaISvFEjJ/I1r3Q6cpcr4gm19L:7+biUOYqKfHQ7neQxpcE9BBD
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2512	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2512	AcroRd32.exe
2512	AcroRd32.exe
2512	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\植物大战僵尸杂交版v2.6.1\【常见问题】杂交版指南.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 210cfb4df6aa3d2d7257b53a3573acc353a20715d0acbb61d5c8043b18055348
MD5 6e97708f86ebbc69774287b410ccd4ec
SHA1 ac0ebba3827c9299994d0971f445139549cbb0f8
SHA512 b5764a00b23dd62dee42ffa65b6028cf1d89c7b49d043d91ee1a2c73fb292399bbf15648ac6b9ed370e487eedbbc272190cc319c920d8a3c7102e9989b67e535
MD5 SHA1 SHA512

Submit Download