Analysis
-
max time kernel
94s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 01:01
Behavioral task
behavioral1
Sample
e33202769f99aa0145cb27e2ac3436a027155eb7c8a138b37482c04c1c7b7b4d.pdf
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
e33202769f99aa0145cb27e2ac3436a027155eb7c8a138b37482c04c1c7b7b4d.pdf
Resource
win10v2004-20241007-en
General
-
Target
e33202769f99aa0145cb27e2ac3436a027155eb7c8a138b37482c04c1c7b7b4d.pdf
-
Size
53KB
-
MD5
1b2eff4456dc46c63d78ebc78e83f869
-
SHA1
e73e0c988f5819168df91b550e8122eb7aa96f7c
-
SHA256
e33202769f99aa0145cb27e2ac3436a027155eb7c8a138b37482c04c1c7b7b4d
-
SHA512
18144ba0a7af06321cf6a834c69dc7b4f31c20ce7f71a78387ac4a45141ca4e47cc5fc8300977123937b28c664c00e8b8efb33ba11d883d439d14927614e0faa
-
SSDEEP
1536:52uqrrrrrrrrrrrrtT1Ve/SnFsU1hYMnTrilqRllHppENOwXHQgzDxH:5orrrrrrrrrrrrt1cwFsU1hYWuwlF3wD
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1056 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1056 AcroRd32.exe 1056 AcroRd32.exe 1056 AcroRd32.exe 1056 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e33202769f99aa0145cb27e2ac3436a027155eb7c8a138b37482c04c1c7b7b4d.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD57adf77d6199dc250b3a851549c0c2f43
SHA13646d21d840e05ca301c9b772a151dd6e6bcec98
SHA256acc22139070df6037de44542d7b1afdfe0c605e3528d29a0fc38bf80f03187f7
SHA51253edfeab7ecff07fdfb3ceb4266ff7c9d15d310850c78fb48087ccb40c9af20407bed44653a3e7c2c70b27a9bb01e8e99dd6c12be30211ee72cf415711f48694