4c9acf9fa885bf772564bfaa6771b776b45d0e8daa3ce0bf89b05f4d87085686

Analysis

max time kernel
150s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Burst Royale 0.9/Engine/CompareTamplateFile/old summary.pdf
Size

8KB
MD5

a1038e481049b723eae0cccb16a2be03
SHA1

e1cf008fb7429763dfee7fb42398463251a21cf4
SHA256

312ccb45021cf9df3cbcd56421a259a7c1ee961f9be010871a198c3b9a4f4793
SHA512

292f559e8a7e9366fddb02a0500a2ec58df8017d1a42a104314545e16572e5905102f8093478d298125b100cfec65a16372eb345acee271d0d03bf5dadf2ad8b
SSDEEP

192:P2hD39ovv+BvdpUhLwhVj6ao93kMR/rr/N:P2hD39ovv+BvdmkhVj7g0mZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1672	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1672	AcroRd32.exe
1672	AcroRd32.exe
1672	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Burst Royale 0.9\Engine\CompareTamplateFile\old summary.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ea1dfdfde891493ef00407e34c78f70a

SHA1
41c6199d8f248d04f1d2f1d60fd99c572a92594c

SHA256
ba4f5e341b5fe20ebb98b1ed5807a9d5a6aba184770247ea4530055ddeca015a

SHA512
af7ba0be1c1c423090e634db9c7d2f162f88ad60e6ad8022d951032eb691da4e03331107b08dbda13cd317bb669c8a6fef75998313df7d1bf58d9901ce918e09

Download Submit