7198e168723febc429a20269ec02fa049458a85f590d8ed779a9b063e9c46f5f

Analysis

max time kernel
8s
max time network
1s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Builders Online Invoice 0504335337.pdf
Size

22KB
MD5

cfe31bf356c07eae576522ff41e3a7bd
SHA1

c23166ec9fecd0bb697bd53c3d9db2674c30996c
SHA256

ea72910454d955a96717ca228b795b4e180d4ec3fdc7ccef3e19edd01ce649a6
SHA512

2284923cd146d09c664d66826b5209a7828d4149b7a60a5d70f87508914b4fe21679eeb41c3679b7e16535362e345d2a5ed8d41bf2ae9c5600a394d94ad9c336
SSDEEP

384:MLCwhpQ3fudx3FaIhxOEqx7fUB572ICPv/mTu0:UwWdJFa04EMUB57O

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Builders Online Invoice 0504335337.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
68dfaaf2980f2827d3571fb84e54016b

SHA1
d08a86774a709dd53827f737e8290e7046b2776a

SHA256
7389ef10cf420647020ee56eed6ad4aa6f502b5b5b5b1e16ecae211f2c61dabd

SHA512
8096625d04e40721b8c7e9d0cff3b1a742d42846479e929e27a331783af504629c3a810290ae0e6f338729c0cee69026f8fb6510e53a8de33994ac15d4ce99d5

Download Submit