4fbb374c45732c88522bd3439e9415bf568c683236ede336b4e61d161155ba12

Analysis

max time kernel
95s
max time network
20s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
17/01/2025, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KayKit_Medieval_Hexagon_Pack_1.0_FREE/Medieval_Hexagon_UserGuide_v1.pdf
Size

8.6MB
MD5

9d989ae2ad4304ad01fcac914238b0f5
SHA1

777a3922235cac835a301f513d5c96c097785307
SHA256

32d90083e8b2e058b847e62a2a05cb82765614bf52d8493ac61190a0f7e4d2a8
SHA512

7e58abe3a823d16f60732be3403c8c1978aaf02afc7db97abf28b1963fd66c7e67977bc8e2bf99a763cea0bdd7173b4a353af1c3a01cb1d7f00e6ed3c739897c
SSDEEP

196608:IzGLkzC24R/YrUozuB2dvNYh/rIdYZAFEBXNlbZx0vdWA:3LjaUohdvN6jFSFEBXNt0z

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2900	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2900	AcroRd32.exe
2900	AcroRd32.exe
2900	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\KayKit_Medieval_Hexagon_Pack_1.0_FREE\Medieval_Hexagon_UserGuide_v1.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3ea070c2f11d24415120eae4d297e3ad

SHA1
c684baa118f1b8e17d00ae1ae1595a280a1a568f

SHA256
a4c4c5c453a082ca798edb03fc125e465af44ded3653b6a2a7f1ed247ad689af

SHA512
dff99543a34afef68c7b7d73b84faa66c41dacb0245b0d051f5df85e130b06d378aa14f850df4b27bca0d7ddf7fbf4026f48985d4d35ae0145e65c4a22e0c4f8

Download Submit