279041fc15f0a1d0076e063296ebf761bac7707b33f22435af6234511f6a5c2d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Service Booking Everything you need to know.pdf
Size

257KB
MD5

3667fceaa96d2acae947ca47d31ee0ed
SHA1

9ec8a85d79f1ad0e93b2e5477067c71e9e0d5fa7
SHA256

4e1a8e7b03db97a985fb5a5f04fe0e931466c10c8c013dfd4bc58fa5b8c29d9b
SHA512

1b8cebd6e6eb837623d8f7aefdb630514f7f332efd1cf121a790aef3928c66f6335b458daf0188e17fd9bb16cba1f1edd5dbd6f8d1fb9a449d3c1846b07a521f
SSDEEP

6144:C7MmCYQHg45muqvPypG+o6CcuDOP+r+blr9JQe:C7MxYQFvmPWXo6C9q+r+me

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2812	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2812	AcroRd32.exe
2812	AcroRd32.exe
2812	AcroRd32.exe
2812	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Service Booking Everything you need to know.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
10dee4138abafd7a572b18ec6f197aec

SHA1
e7536f0e4f84b95cf435a37a28f98863a5af1803

SHA256
0e8aef037d5dfd719415817b30c71a61350273c1568cf08f2e9249dfb3b76453

SHA512
924016079f76aca2b70255906ad93b84325cdf08806894db6fa8ea3cecf1074c9dfcbebee321aca8131c6f655ee1296e077449c2b6334895809a9bf602cae92b

Download Submit