5883edd9c939f4212021ed78572054caea0d3b0cb5c8d938357a7b499544b61a

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WebM Premiere Manual.pdf
Size

477KB
MD5

d13a10fb1bc16050b02fc348bf526a33
SHA1

643df82d8db61ede91b7fd16a9282781303acef3
SHA256

c715c8d934afd39cfe7b51a6ea046de9f38175411dd293753bb04948e0dc7f8b
SHA512

2251595d96a7c515f4a5141441b8ceb658b36178607fcc303f21b88425ca0483ef808f26f468cb9f917eb63e1b9a6fe192917335d682f4465705cf8ec96d8b04
SSDEEP

12288:Ap00o9mVbglgCwQM2VXpAhi4x6Ia1eZ6yKwJs0:AuhQVElgCmapAhiK6h1fdAb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2424 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2424 AcroRd32.exe
2424 AcroRd32.exe
2424 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2424	AcroRd32.exe

pid	process
2424	AcroRd32.exe
2424	AcroRd32.exe
2424	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\WebM Premiere Manual.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bd7b5d2b312725f3679d2cc339737ed5

SHA1
b26e525c1abdc83a39ce7154837c5afd36c7347d

SHA256
73216920a6bb409e95b17cf6b2e761c4b69b6e382057c22c8ea1f8a47193d4b0

SHA512
04a79ffff13775e176eaacffe819af1aba144bfbe66c6dbbaccaba47d28eb8b030f1f6ee9568671102b5c0e5311e2aa30688dfdfdfa1994bbf45b82ac1c6c2bd

Download Submit