Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 11:06
Behavioral task
behavioral1
Sample
17503b81d0587408c6b25b8788129d3a6314a68819b91950948a6d9d20992f96N.pdf
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
17503b81d0587408c6b25b8788129d3a6314a68819b91950948a6d9d20992f96N.pdf
Resource
win10v2004-20241007-en
General
-
Target
17503b81d0587408c6b25b8788129d3a6314a68819b91950948a6d9d20992f96N.pdf
-
Size
99KB
-
MD5
eef3b1ef95f8c9f324735a19977ed470
-
SHA1
92dccdd88c9e16ccbc47e3d1de6e343cdcf8bd70
-
SHA256
17503b81d0587408c6b25b8788129d3a6314a68819b91950948a6d9d20992f96
-
SHA512
21879788d76116d697b66056df45ff475ded2a21d1a4a2f6009d372861e685b9f8384bfa67ef26ce75118ab5314842cac787abc99d590b57c48d9dc6618780b8
-
SSDEEP
1536:DkfjpJssM6nD4bgczbmfh9bD9BZ8PrZ3eEZI2Qg9Cp038FRexqIgrnWH4yolgfiA:gbpKahcXmL9BuPrMEZI49FMFIUrsaEqY
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2624 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2624 AcroRd32.exe 2624 AcroRd32.exe 2624 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\17503b81d0587408c6b25b8788129d3a6314a68819b91950948a6d9d20992f96N.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2624
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f18a215ce4efdb6ee9d2445fbde048b4
SHA1a5e72a7cd45ec87f06c51053ab69b8a44e7d0b3a
SHA25606712b6aa1abd0b9e02d948054b6291eed3dd41dab6c0ee950c05430be92f331
SHA5121042d5da7e611d10e84ab3e6919841f87e73639a2d4b47d55fa992ccd96f2d5e2546b49acd3567d1443e2aab00f99e754be8caa50416c5b5a86cc4c50f5f3a70