c41ccfd36909d89511d7fb6c01c591001837756ed59989259fb26708de1f0560

Resubmissions

14-01-2025 00:18

250114-alxjystmhj 10

14-01-2025 00:15

250114-akemratmfk 4

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-01-2025 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Resources/Data/info/How-To CFF Extension.pdf
Size

267KB
MD5

180313065942d47df7858ade74cee19f
SHA1

0371b23100df3fd5739585473c3718c4bf85e974
SHA256

b085d1cdbcb15b6e8e12eb2b8f34d5e900509470bcfd49ab9565663960e2f38a
SHA512

6764ac65d610b6f7e1f5c622a03752cef606840603285b5c49924f1a3f06c669c43a2d3083f3d823f457554a2205989e3d6b881189e3160a2e1adcbf21dd3996
SSDEEP

6144:cbNke00sOHmmZx9VDwXJSCCCCCCCCCCCCMo6XHTa6aaFa50cZdD6N9S5uLJXe5n2:cRkNOHm0x9eXJSCCCCCCCCCCCCMTW5ed

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2012	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2012	AcroRd32.exe
2012	AcroRd32.exe
2012	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Resources\Data\info\How-To CFF Extension.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
14a8e39025d76dee14894eec9775ee82

SHA1
9051b0d64e07f00466318af6089c04edb3c95294

SHA256
f85b86d8f11f052d350ca245ea3ef1b508f1837a942bd55d07bb8ad27bc51b21

SHA512
eabeeef9b552a95d576412de06f0ba9b0a05e6c4ba865420606f4380d61bfd33aa55707e84eb9110e53e7f91a84e01047ea5c52d466e9e13ae118d3124adffdb

Download Submit