c41ccfd36909d89511d7fb6c01c591001837756ed59989259fb26708de1f0560

Resubmissions

14-01-2025 00:18

250114-alxjystmhj 10

14-01-2025 00:15

250114-akemratmfk 4

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-01-2025 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Resources/Data/info/Design-issues.pdf
Size

74KB
MD5

3dfe7bc94d051f8744507d80a7ea65e8
SHA1

757b8edcdd5dc02cec00b4024e817b5fc337acba
SHA256

5f92ef23be6c1a6b8cc4be81abc65f65f01c12700405e01bb594f74a98789531
SHA512

6b15bc33a7c871811962ae717d878aba6ba2fd4e275d8ad1f7b5f639943bc098b352fdffa2474e054c771c6919c2044d50c6952c6bd87c1cb6a8e680f30afe18
SSDEEP

1536:iIhRyelDCd3YKpoymCEn/LvT/5D20hU3kT2P0ER0XwkG1Om:QelWd3PoVCg/Lb5/728ER0XyQm

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2968	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2968	AcroRd32.exe
2968	AcroRd32.exe
2968	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Resources\Data\info\Design-issues.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
79b70d01503e05ac2078d5e9f28daa07

SHA1
9d9ca1d0be12a9fd387f68961f381a2c78abfea9

SHA256
4f78873fec8840529b33612dc9b382e9eba67a4a45a1c9922b09f71dad0c22f9

SHA512
714ced10d5b4289bb2b3eab69f3fb7ab978fa5ac389ba0bf8626f7d51e6448110b8a53deb34672426f99ec0ab12fa182f136a32ae3436460392297305fc5d2e6

Download Submit