499ce7e26fd7b500c1e05570bc2266053862c18c5b37c2f72f5ad99a2e32149a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PanoramaStudio Manual.pdf
Size

3.0MB
MD5

b7a4029678c4f0e02bca9f30c79b9fcc
SHA1

0f4576632ba434786eb65d0c66e82a454f192d45
SHA256

064a4303ae1414f58b073152627926bf637ebfe1daeabb10bcaab9c86d6e9c8d
SHA512

d2f5dbcd7d4308198b9ca92459f093c3a33d2397c1231db7bdd0c3026a7356aed3e7df020a6e6ecb5b5d45d4a931db3c1d3bd4851ec05ef98c089c41ce61798f
SSDEEP

49152:WMQR6OOxPKApLbSEFdXd1SnsLgNs1MJPvtfN/VzXDRa33qwpeLGs4undzQUMNjwH:WMQR94PPF2s4v3hRQ3teLGs4K2ktZ19

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2824	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2824	AcroRd32.exe
2824	AcroRd32.exe
2824	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PanoramaStudio Manual.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5258b44bfc4d92e4b9e072d5d1b8846c

SHA1
a8bcf3a2f7edc80d03cf083a2e4927edadcc644a

SHA256
394454acf6b47e6a1b2bc4ad594bb00017b2c4591195900eab2604df4fe45bc7

SHA512
c029ee6d05342176be6c81bbb55a289032303e15e359aa9eb1e5718d4cf7af265566daac4e6b46810715a92c2f7886b04bbd1e38dfa0eef505898533a2ef7151

Download Submit