Analysis

  • max time kernel
    121s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-11-2024 11:06

General

  • Target

    $DOCUMENTS/Xfer/Serum Presets/Serum_Manual.pdf

  • Size

    925KB

  • MD5

    340d32a9e0fb294b9fcedf8f80b5e4b4

  • SHA1

    c23999a13ebd1c2e670ae46b5fe737bd84e4c27b

  • SHA256

    2f468481fc5567872f8e5d30a30edfb0a1ff687188b06961972743fe3423ff84

  • SHA512

    961794083e723a5397de396df1e433b83a7eb403d3a36f66df6523f331a8923fef692b01f026a10752c0fe15f7398118cd85c267a2374c9954e1d64b60248f10

  • SSDEEP

    24576:s+Ot1kEbTk/GNMKd8kq90BqiN2HhdYj+mnI7SC1GvXX+HMFG/HyYE7yBLBTk8:b8qx+mKdtq+BqiN2QKmnI+C1GvXX+HP3

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$DOCUMENTS\Xfer\Serum Presets\Serum_Manual.pdf"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2792

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    400d8e0c107d2510a8f2a86cbc44cfca

    SHA1

    9d984b05f11a6b9dd319404c786e7de242664237

    SHA256

    c0871075def56769c2f21ba7e5937412f0624be90728ca010195aaf1a1607e2d

    SHA512

    e5584d346249171f855d50ae8aded42d210c5677aa384c224069335256e3fda72f930badf045b093378e22b458d04fd6e62f53b644e14c735935ea2a2f8210a8