31b50bf84e4920eba936c321dd56086506b1ad115bbf50862690ffb9fe0c5e21

Resubmissions

28/03/2025, 16:53

250328-vdy32aywfw 3

28/03/2025, 16:30

250328-tz1cjszqv3 7

28/03/2025, 16:27

250328-tyb9bsythv 4

28/03/2025, 16:19

250328-tszsfazpw8 5

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GNBQY-997049.pdf
Size

9KB
MD5

036a6b0818e38574dc32f192be0756db
SHA1

3e9a6c7056cd4a1d3c2a2e897b0880f012b85e29
SHA256

31b50bf84e4920eba936c321dd56086506b1ad115bbf50862690ffb9fe0c5e21
SHA512

7461f3e20417a72afcb66b3574e48bcabfe9acc0fc8f79e7233788168dc65da2b617f19593ced669091656c8793aa6ffa7c9ba8c0d587be1cb03de50c53bdf29
SSDEEP

192:826ESYK7DzfYzETR8wlk2w1ic84kOHHrDYDIlYDIvJoYDIYr:826ESY6DzAYTmwe2w1n8DqYDIlYDIvJr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1820	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1820	AcroRd32.exe
1820	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\GNBQY-997049.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3ef3551fef520dcbed7b70c2e3c38dce

SHA1
4ae8d4dfa37722d94cfc3781667856cf6209f3c7

SHA256
6c6d363a7af71d93e7676ae830ad8cab1d897c5dee0a4c2488333516c160d655

SHA512
74ddcf112b1a8650867472c5d4364bc9207f727de2506a57615745e7c1146c2768d637454e84e7adf547223613bf6f683c372864992e651edb2298f96a60c561

Download Submit
memory/1820-0-0x0000000002B60000-0x0000000002BD6000-memory.dmp

Filesize
472KB

Download