38b3ed66ac80892a8564b4f7896cf97249db45e002ed0d2008da4c27fa984cfe

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22/01/2025, 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OptixPRO Tutorial german.pdf
Size

307KB
MD5

5facdc13577f4ad2babfe7d125154298
SHA1

111b377b23931c0fb5813e269af077a6fbdc108c
SHA256

cebd792c17c5135cb1dcddfe349772b80525c89f5b41a760e4289b15107761dc
SHA512

9520aae25d77a2900b0212cbcc9e0bc109667fb6c6efe8928fc9f6f22f02cc03f86ce52553d1267643b0adda8e09add1a80f3e48e191dea1de11130da38def21
SSDEEP

6144:At3YS7fKkRbBAOPV9vRv41QLPmI7JYb0DVzesMqv:WYKtbBnPr5vIQLtV6g

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
844	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
844	AcroRd32.exe
844	AcroRd32.exe
844	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\OptixPRO Tutorial german.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
55dbde01e380ba4d2b1c1c2de5d14e71

SHA1
a7f44b177cf64f9b478566beeb7d2cc820b6c65b

SHA256
c8aeb6ac3e67bfb2a3f99e780c5bc26f0c948bc4473d271a98a157b27fb53812

SHA512
85b36114bcae7933df2870d20cf0b2e56716844e8abaec85e1f5005bfadf4f3c0440faff2e8e453e2191c299d484e83efe17f625e0521a9bf636f9e89ef682b4

Download Submit
memory/844-0-0x0000000001220000-0x0000000001296000-memory.dmp

Filesize
472KB

Download