24b4ab604c01ad537704980ce0e2dc8f97ef4f59e0453918eed6de272dc93ee0

Resubmissions

19/11/2024, 16:46

241119-vabhkaygrk 6

19/11/2024, 16:43

241119-t8gxkatjhj 6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fv09004135880212400FE8853.pdf
Size

60KB
MD5

4557fe1fc4d656ac739d6521b7fa4d75
SHA1

770f68e10ff06428c3cc6205e83a57a93c9b6789
SHA256

4bb25beafc7efa460beaf216d2248d7a310be21d63669cf20074ba2ed3fd721c
SHA512

d4d27c1c169b49229c2db46dcec0d63f32eb2d9dd878c60a3615d4493d5331e0ac3890a72670089cb3da019b1c6b34804c93cc3024e161b480a38df92c694e05
SSDEEP

1536:nkkHlPFAhmzpgYCGeYHhIsHn8wT0d4EzNJ36:/PFAYzpgYCGeWOsH8q0dpNZ6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3048	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3048	AcroRd32.exe
3048	AcroRd32.exe
3048	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fv09004135880212400FE8853.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b220ba75c69dd99e41ea756a3ebbe4d6

SHA1
2592424ce85c16b357870d6ead66a02715ae2ac2

SHA256
c5c2584d7c8cffcdf7088d5ffef68e0ff6db957339b8aae4006a40f948d63b59

SHA512
6e9fc54648f4bb46f6f3e8794ddf923811b40a091a82858e15bd5c53535f07bd8344b5830e0ac7280d37016ca794fe5b47eaaf8d6b54fcc96e3b6e4750fd313f

Download Submit