be14698dddf38be027a4f4178b4f33d5d98e14f879064812a15e54c1eee91cb5

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NoCry Ransomware Builder 2021/Manual.pdf
Size

875KB
MD5

e3d95397281a7816b32ff76c8e760521
SHA1

cef2568464f0cbddf3827466d142ac6e4c8cbc3f
SHA256

899d4ae97777e831504fecaeaba405df972acf486f61969386e5f2928f3f2e9c
SHA512

b0c398c4df804fb2a63189a30ada4b5af34e3afcf2d329bee0f086c4b74f49a51814ecf005c125e0e04e647d9d4145d5017ba8bc0a6bf6c32a18dbae9babc51b
SSDEEP

12288:fC/iIKbwBysOd7vWFwAl2uGKKadszDfOS0Z8vZeekVqon6Ma5Ejqj3uKbeUIRT3:a2TWi22ueQgyZ8vZeilfie3cz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2236 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2236 AcroRd32.exe
2236 AcroRd32.exe
2236 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2236	AcroRd32.exe

pid	process
2236	AcroRd32.exe
2236	AcroRd32.exe
2236	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NoCry Ransomware Builder 2021\Manual.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
50f47d0a6318f0ad90dbbb9e24cba44f

SHA1
982e90f9c1ed31c6833d0689dc35d6dd7a591d22

SHA256
100d16a41924e08e4e41212d4551195adbab8965301edd247220ff38ea78b4af

SHA512
52ed83b975f9897f5c3342545d9f468f6f141a1a2cebfd994021e9f28d9d46d94a38c5100449cfca3f4afbf406d6940b8644e7c48ad4fbfa87678cf2772e3e4d

Download Submit