c41ccfd36909d89511d7fb6c01c591001837756ed59989259fb26708de1f0560

Resubmissions

14-01-2025 00:18

250114-alxjystmhj 10

14-01-2025 00:15

250114-akemratmfk 4

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-01-2025 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Resources/Data/info/Introduction.pdf
Size

68KB
MD5

355089b46b60300d2c0a6f397404fc11
SHA1

fc1f801427a9cde55a907aa3316b30fbede46faf
SHA256

16d8c5cb8d2ecdb6ca174dcba1e5b0450caefa89226c79f376f9e67e9ca060d5
SHA512

5f4349b2a664661446b0a7fa4b9a5fefbf55446886a2028f40043bd3ae70bfe5b5d4961915aeaafd5e7dd6ed8a9bbfa1431aea41ae79c3ebd8679cf854ccea0b
SSDEEP

1536:HbXiyt80qkUCg/H75oIufPS50heuPkMUcY2GDEA7f8EoeP02wC+QND4brK:HFt/RNKoxTeuPfUL2IlXoePltmrK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2996	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2996	AcroRd32.exe
2996	AcroRd32.exe
2996	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Resources\Data\info\Introduction.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3e6392847ad94bb41ce2f12a8d9e0559

SHA1
8e2f53d5c3dfc03d38df8e0be48fb74148b2b003

SHA256
d14bb7917f514fae5c6145a62789945353fcfa3485db2a864fa0611e0e61c1c8

SHA512
50c7d54c313aa4fceed02fdd5c41fd2cb5ac4cbbc5d3be0ffec23441c5bfa0d679d2eaf4df24af0c7198261bce2994aea3cfccc972a0142662af94202f4e8e14

Download Submit