9dca05d456e7a2f665bc3d92c883574754718441a6075de6d09a918e67ae1035

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HowToBeatPayPal-preci.pdf
Size

3.8MB
MD5

ebf7b19ffb7eac4ed326636374c7fe18
SHA1

a2b8e6bf659720d1537e416b70fa015ab7abb8ae
SHA256

d129fb349f777afbff5b9d833c547b809b4e2a37f56efc030cca228f1049b981
SHA512

7c84cf201d3032c28a9a143fc64537b999e9117ad092e01da2838a17a31dad61e5f4d5970173169c173fd193d13b4afc3e8c29744f5aa8507aa6c472a90c0d3f
SSDEEP

98304:X0Wz6vrunXB6Q1jXofcaRgxNDBYL/XrZmtYt3jKz:kW+vreRv1rofclDCh4YZKz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3004	AcroRd32.exe
3004	AcroRd32.exe
3004	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\HowToBeatPayPal-preci.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
dc2021eacf05f6670204e33879b4b067

SHA1
0ca5fe540eff7a247a58a74a2e324118e95ad1e7

SHA256
b6ba09a33100ebe8afed873473aca8800df75e53cadd97b39f40d70f0aa03271

SHA512
1cf518edabb3729281ccb426d581d11f68fad2195e65c3e75516afea51ed8d2cc4259c38175cd8d715c8e6d01cc254b571464ab0719bce2d2ff970e149e07980

Download Submit
memory/3004-0-0x0000000003380000-0x00000000033F6000-memory.dmp

Filesize
472KB

Download