7a1e837726b6dd6d567e3f9ce15154bf2b7784f718ca8c2e979af6ed5a2d2c5d

Analysis

max time kernel
839s
max time network
839s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17/03/2025, 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Kami Export - Marcus Plummer - AWT Syllabus.pdf
Size

435KB
MD5

c376379bcf9f35bb154307200f251fbd
SHA1

f219958a10e2c0c70f00e79256454337153fd170
SHA256

7a1e837726b6dd6d567e3f9ce15154bf2b7784f718ca8c2e979af6ed5a2d2c5d
SHA512

38a7025b9433349c01c738573c5ceacc706a5cac43ab93ddfd0450064441773548cb77a58a222186da4a401378646fabafcf8b49339c13fd344ac882cd6da0bc
SSDEEP

6144:emneU2Kt2F/AmEmRPGS12EbftIoPFEh2YS1FoTpZAF107ieQg3:feU2Kt2FomrPGuXPFEEb1uT3AoQg3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1740	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Kami Export - Marcus Plummer - AWT Syllabus.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6aca77b6c14b0537847590dbca8791b1

SHA1
7a089e03d7778e21c1c8a24837199700d0d02081

SHA256
226257956421cc05d521348658a01ea9520414b7de6e28256b3e097af3aad2ff

SHA512
4a15c237e45fed2a2ce9dfad5220748f234a6de1f2f234ac5a947d3ba1e64b145c18bb07ac6c0757473548f941911c53f9503e3c231b16966aa8cb7df687f207

Download Submit