3627d3266098a60da43acc2cde5657e8fdb28dc762fe8453e7d5e051b92ee999

Resubmissions

21-01-2025 14:18

250121-rmh7dsxnew 6

17-01-2025 12:26

250117-pmb2zaxreq 6

17-01-2025 10:57

250117-m2me5svncl 6

14-01-2025 16:30

250114-tzz2savmfn 10

Analysis

max time kernel
118s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-01-2025 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IDA Pro 9.0.240925/Crack/hexvault_server_90_cracked/ida_teams_admin_guide.pdf
Size

460KB
MD5

8189d2feb089ff6c3ce2a47c1288ebbc
SHA1

b6b8847f05b600f07bdd42a9ccc1cd5e513beb8b
SHA256

1ade3f9a319eb439b8e1e04da051fdabd35d132cba878cbe5381a0d7265a318f
SHA512

442356e59196ffce7ea7fbc2342bbc50f81a0aa01552d2d6cdead64e17a0b79a68a838fd00752b07e0c14a8c7b0189dd84615a34d9bcce27f0c638ec52622d08
SSDEEP

1536:t9IEBIu/MItNJ/1yAuIlJxYs1CyXOh7wX/XOh7wXkUkNUbU5FOeLX3GjnDr4EE3U:kS7Pr4BsGbGeugsLB1t6ZE8tJ+AB4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2508	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2508	AcroRd32.exe
2508	AcroRd32.exe
2508	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\IDA Pro 9.0.240925\Crack\hexvault_server_90_cracked\ida_teams_admin_guide.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7a57807f6c6d1205c92531717f3c1c06

SHA1
d6f030fc23b67fdd807b25efd34ba5694ebbe5d7

SHA256
44a1e42ea982b9dc61cb6c9ce79e43ba33d1ae1f37683f0a0dd15d6dbeefc324

SHA512
e89fc41abf5b4fc884511b144b92cd748104f1d4760dd7b395e7a6e3e7a68804d530da4423eb3f0c35c1273b8ba8c4d603ad2c98456add52669e04a524b8dd6b

Download Submit