648eb3dd8252073b53f16887084c5415f56e90877aee69d29393efe1382679b4

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-12-2024 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eicar-standard-antivirus-test-files/eicar-adobe-acrobat-javascript-alert.pdf
Size

13KB
MD5

657c1ddb8eb73b9cef5c31bedcf0dbe5
SHA1

aa396fdf3a2c4a6f7ae8b018c6365ee5b6246ded
SHA256

948ee1d9e0df1dc678f420239fddce99e0268978e65502d0ec31615b0a57b29a
SHA512

f06adc26a452db92516c341d5f6dfbf18440df5af06b3cf733f9065d1f7e4a9cd9b863cf55de55c594e935b50030db01db5f069e78c77740f9b6c217236fb7ed
SSDEEP

96:3Oa3FxJS+D2AHYkLExQLVhjO2vMkLEwVScjnhhm70r1knn1RVWwKpCL:73zJ9h4k8Qfjkkzd0wpkaCL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1288	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1288	AcroRd32.exe
1288	AcroRd32.exe
1288	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eicar-standard-antivirus-test-files\eicar-adobe-acrobat-javascript-alert.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8ce9edda4790a4135ffb52e9996b03ac

SHA1
6fe977b488c486828156f109b39083596bef7a15

SHA256
2d2e0c5597b7188ed84b9f6ee12f85c62df5146d7d898ab12c6ac0db9f639162

SHA512
4acd256dbdb16bff18c3fab1375a3b27c2c043097106b8d1b295ff84a1d9fc6abfae5c795f1086b49790b0449bef572db419e4b5a5535f59751f95abe2da2dc8

Download Submit