5883edd9c939f4212021ed78572054caea0d3b0cb5c8d938357a7b499544b61a

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WebM Premiere Manual.pdf
Size

477KB
MD5

d13a10fb1bc16050b02fc348bf526a33
SHA1

643df82d8db61ede91b7fd16a9282781303acef3
SHA256

c715c8d934afd39cfe7b51a6ea046de9f38175411dd293753bb04948e0dc7f8b
SHA512

2251595d96a7c515f4a5141441b8ceb658b36178607fcc303f21b88425ca0483ef808f26f468cb9f917eb63e1b9a6fe192917335d682f4465705cf8ec96d8b04
SSDEEP

12288:Ap00o9mVbglgCwQM2VXpAhi4x6Ia1eZ6yKwJs0:AuhQVElgCmapAhiK6h1fdAb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

3032 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

3032 AcroRd32.exe
3032 AcroRd32.exe
3032 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
3032	AcroRd32.exe

pid	process
3032	AcroRd32.exe
3032	AcroRd32.exe
3032	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\WebM Premiere Manual.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
93b5ea34785e11c179bfbd14db105e77

SHA1
78901dbbcc3b603b15f848f619dfb18909c2c58b

SHA256
3ef6fbcb6a4f0d6d0fb99b647632cf682de10f6904de990784bd950dee616d9c

SHA512
df59bc0edab75367072d2c1c8e03600992380141c8087fd6bef340735d118b15d74247b31f163c88bbadd8c2dcf07e1fed9dc54ceb84b6413151f68bf09d5aa2

Download Submit