31b50bf84e4920eba936c321dd56086506b1ad115bbf50862690ffb9fe0c5e21

Resubmissions

28/03/2025, 16:53

250328-vdy32aywfw 3

28/03/2025, 16:30

250328-tz1cjszqv3 7

28/03/2025, 16:27

250328-tyb9bsythv 4

28/03/2025, 16:19

250328-tszsfazpw8 5

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GNBQY-997049.pdf
Size

9KB
MD5

036a6b0818e38574dc32f192be0756db
SHA1

3e9a6c7056cd4a1d3c2a2e897b0880f012b85e29
SHA256

31b50bf84e4920eba936c321dd56086506b1ad115bbf50862690ffb9fe0c5e21
SHA512

7461f3e20417a72afcb66b3574e48bcabfe9acc0fc8f79e7233788168dc65da2b617f19593ced669091656c8793aa6ffa7c9ba8c0d587be1cb03de50c53bdf29
SSDEEP

192:826ESYK7DzfYzETR8wlk2w1ic84kOHHrDYDIlYDIvJoYDIYr:826ESY6DzAYTmwe2w1n8DqYDIlYDIvJr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2316	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2316	AcroRd32.exe
2316	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\GNBQY-997049.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8790f313bf3fcdf068a4daa4443c85a6

SHA1
191a4f11b01a542ef55f6cfd2a48998b18f10706

SHA256
17f04cfe07edb13abf5129c079b083bd972278cbe33fed650418a55895086851

SHA512
e5cdf9e6b62de188bfa5d28e59670ae9279b4f3e9fd56e7382349f9143bb269e481fcdef21639a728ce63ff73a3d455cc8fd2984e4fb755ae689f4a641624258

Download Submit
memory/2316-0-0x0000000000D50000-0x0000000000DC6000-memory.dmp

Filesize
472KB

Download