13483dc0f61d29683c45092618e98775462e5f68805de9931a5802b05ddda5fc

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-11-2024 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GrowCastleAutobot-main/gcAutobot_guide.pdf
Size

1.6MB
MD5

f56aeeeeb0ab6ee72d8b9ece1884eb90
SHA1

eeded003afdd4b0d3b1008c63df1b2be175d98a8
SHA256

616072c7341437bbca2b02f46da7c2e19c08734cc2d0eeb0567a6faafa35fc13
SHA512

77045f452c1d33a37f592bcd04f9d805395d874b8b39a8c692b862b72ff72e2db6219ff21f724220716e66fa879c345aff39a795b30676756f0a65858b31575d
SSDEEP

24576:QoGRxKFckzHcHHPQouF8XA9KJDRw+GIMHrnIAuMhi/Rfly4MEbwO6p1AZf6oskxN:4WcZHYouC/JD1grIAu4uRnMVO6p1M8E

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2096	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2096	AcroRd32.exe
2096	AcroRd32.exe
2096	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\GrowCastleAutobot-main\gcAutobot_guide.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a34c91b974686c957634ac96f1b17d1b

SHA1
fca2a9a7281781929c86466969761ebadc7cf5dd

SHA256
bb7c8d726238dbf16e32f0015064971a3fc3095cdc8b04cfc20f9d776e4f2ea4

SHA512
71eb4a0c94e9e5e981f12769906981e1fb8cdb4a494fe2896266ad2ecd0b09a946004966af503699e3398953f66c741a8524104267298f533ff3a23e8df53cb7

Download Submit