c41ccfd36909d89511d7fb6c01c591001837756ed59989259fb26708de1f0560

Resubmissions

14-01-2025 00:18

250114-alxjystmhj 10

14-01-2025 00:15

250114-akemratmfk 4

Analysis

max time kernel
105s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-01-2025 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Resources/Data/info/NEWS.pdf
Size

475KB
MD5

951af7e5c9f8649aba87836b7e0a5bc6
SHA1

461a9f335c280bde86169123a7a6a52e78f29772
SHA256

37c0c814257d592cdc9fa4f65981a5de73011e1394d193b23968ca0f75f3121f
SHA512

26beb3339e2f72ad5433d7ff4f138fad494ae6225999089f6c4510d46d291d1bb53573e6f798d9a20fdffa6936e4a6fa95b6ec0a4fa1a51cc379d25f0a91bd0e
SSDEEP

12288:puZbEcShGrMZS3lglOSZ/ApESaKT/fRSkgdwW:s1ohCFglOSZ/WESaQRSk0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2524	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2524	AcroRd32.exe
2524	AcroRd32.exe
2524	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Resources\Data\info\NEWS.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6a5360eff15da8ec8f66f10f01d3901e

SHA1
5465dc9a76c0297ae936643af47385a7905356e4

SHA256
49988f77a753bcd3c2c62b387fbb61bac152ba3e447812c20c1a1c93de2cc4af

SHA512
2e7ec8a182ea52d2d040062a5bcbff773835fb1eb4995797c3495ebec3db8836ed7c3d81158a36b5957b4922454a0cc962d3e2e0f4a9aa157cd6cdbba09baebe

Download Submit