f403174c2dcf0b43c2eb338dfcc7b44da183ff36a3563bfbe56edd82e77fb69d

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
30-01-2025 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3.8.1/Blackshades NET Setup Tutorial.pdf
Size

3.2MB
MD5

9ce4414c839c0e9dce526474530e8d0d
SHA1

32bc5cf25bb1ff90d576ed6fb476297510fb6d45
SHA256

1ed267ec56428c7bd2c654ebea6943eb2462738acfcc221da10ff88edadc6772
SHA512

b35258f0ead5de7baf87cbbb1f9f9719a5f4d48083c0b5e115a3d367f5e53cbda63bdd40ed9a7a4e9f7c20e03d4fa8a5e0be96db20f0c8ae45a39c54828cf1e5
SSDEEP

98304:2wchRIS2Vx8ElEv21M2jo/BtqG0wuiU/lpd:dcbIS8yQ1M2G6Bt

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2604	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2604	AcroRd32.exe
2604	AcroRd32.exe
2604	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3.8.1\Blackshades NET Setup Tutorial.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
dad1bda402486220faf3a059d1295021

SHA1
dd8af90f2692a655992326eda8e5b168198d9f0a

SHA256
f45825154d11d950cd3640ad04a74a665870e9c0879307abd860dcc0c4a4ffdc

SHA512
0b30f91b70862a14ae98ed018ae4a84e3c0df9b161cf423bb258fdf985effa13cd3fef3782a0febe9dac0aa0a2eae037a7ebb5aa10785072421b49702db1f08e

Download Submit