009015f2b784930395ce3516e02b93a71b6d88f683505257d7c476f9a8b76168

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DOCUMENTAL 1-2.pdf
Size

10.7MB
MD5

5bb29bd131170083a90133c0348c2b2a
SHA1

691a50669b753854ef6fc7e2edc2738b18b4e333
SHA256

40608ce54fccbf60f11e9e52e024201899b0c0d8708e249b55215086b2ce486b
SHA512

1190c036cdf2d112ff16b9e364c80770c4e2285246f4a3c214f5d0307fe860571d03b3b273636e1dd643e95cd06fcb0244846e0c8d02ab7b6551ada91ac6c2a4
SSDEEP

196608:peDYOtn/au/765M8eUiheEogwlgkHtqnFBItzXZt5jTRsSTKs/EywihE68ieFcmL:zs/au/EM8Y89lgkAnFatzXdCeHRhE68N

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1780	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1780	AcroRd32.exe
1780	AcroRd32.exe
1780	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DOCUMENTAL 1-2.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
887e7c1c4ead3f0b9deb1dba1212c792

SHA1
710d1846a544363bd1715cbba4f7f13bfbcae024

SHA256
fcbcb62f64ee144d8bf68fbe7fa933467684971fd660de7c5f654f4678caaecf

SHA512
7b48c86df67c09f05e2acd12a466eaded729a74cca88d1784f636732cd489d9e24317b528ab66f579649f9ce4c9b3f3dafc70bec0bd85c767ada6ae53ed1e465

Download Submit