82623031e0f5e1cd75fe03f791acb29caa4dfc1f17084866ec74597dfd6a45bb

Analysis

max time kernel
96s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
27/03/2025, 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KAS Career Services.pdf
Size

87KB
MD5

5b4c3655b6e6b608aa940b42b8b14974
SHA1

13b2653f8b8361e9d1b7c6a2b4f97849e4762d69
SHA256

deea608a7b59799e152434f2b6c6711c2727bd211fa82a082e2c628fd85014d2
SHA512

3299fe45f8130608af882f0f1624717c987c8cd9380e5a2d3a43fa2ec2cc6ec32a264669afa55b0e49bc3b346a477a3905259158d0dbac0df4408f06918255e3
SSDEEP

1536:xtck80F+GwVNR//U20RxVCiGUNa9QgmBmV86Mysgi/tNBWoFKSQeR0wIg2/:4K+RNR//F0ZbnReBMnv4otKwm

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2108	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2108	AcroRd32.exe
2108	AcroRd32.exe
2108	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\KAS Career Services.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
05e52050a6f988543f38a766269fa8c4

SHA1
ebbe091b94f0ad454d4ca14efecded793f2abc8f

SHA256
3750c81085b0d04b4853d5ac50d3d004359bcd3aa5d3e6fd316b374289a128b8

SHA512
7d31896e6e59f7abbecb02adfd3f2b830390c5486d62933e754fa6317fbc4c4298bc5a633d8a159ef9eaae292b18f0484fe76049c21a694670d686a842842fa5

Download Submit