Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 10:47
Behavioral task
behavioral1
Sample
msimg32.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
msimg32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
rename_me2.pdf
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
rename_me2.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
저작권 침해 이미지 및 비디오 - Yulchon LLC.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
저작권 침해 이미지 및 비디오 - Yulchon LLC.exe
Resource
win10v2004-20241007-en
General
-
Target
rename_me2.pdf
-
Size
220.0MB
-
MD5
65062141a5aa00068b12b74a85d67b41
-
SHA1
5ba2d2c53978b4de3a123d79fa3ed60e93d86a48
-
SHA256
133be53c484a7d2f18f7919a393b60f4276f7900417bcd7bfecdbe977e750fb4
-
SHA512
d9bdde0c7293acbdf4410b454cfd9a1ed6d645b69a108d88292cc3008d42909934d269d03c94d06e4868b1b2d0c6b0a260a3dfaacca9338e227452c307998231
-
SSDEEP
3145728:96lH+byk0ZggBznCh2HCea5bQ92NmDVr9XqnZGWp:
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2068 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
AcroRd32.exepid process 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe 2068 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\rename_me2.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD518d95f43de62ae093c8b37433a860b67
SHA1db092c73894cf369c333a872bd97c85138cb62e7
SHA256fbbb3905d65f8dbdcf8b64bfaf0dd3674e9265d3f7dfbe460870d7a27ec93290
SHA5126ee52f9b2daa3ba717663eed1decc808dd9be09c1f8a1dfd265c40b923e972ea48758131e9e781f511188750744e9ce57b05ee079673353ad0964506e60ef366