7d5308f1c823b68627761254e9efe552b4dc19ece1c73672b9a82623c853f21a

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24-07-2024 08:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ade54424081ffecca245fdb10c743f0N.pdf
Size

71KB
MD5

6ade54424081ffecca245fdb10c743f0
SHA1

ff5cab3885e49f4b856ce721d0fbf1ea29e664fa
SHA256

7d5308f1c823b68627761254e9efe552b4dc19ece1c73672b9a82623c853f21a
SHA512

9cf91718f0a214148a48bb8231a2b3374cd40a0d5a9bb7918794f2f5b2fa3bbb9c1e2a6c5e3deab19d1c8e08eceafb37134806b03e35c07bb094168849893713
SSDEEP

1536:m3g4/ojPRGORpsNP267gZ/15fz9c80zTP45pnVMYw:/4AjPRGORIuRB1vc80zTPanVq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2984	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2984	AcroRd32.exe
2984	AcroRd32.exe
2984	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6ade54424081ffecca245fdb10c743f0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
dd2422bb6ef8a3d19c60bb8a097cd71c

SHA1
3405914e60fd60057d37e83be363292ad6c010cb

SHA256
a7740344c0aaf02730341d84c00c25e69cb259b415f6e8c98c43ebb4244f9ce6

SHA512
65ada5e4b55dbe248a7d43ab42a6a2bb8b33e1346dc49eb299470ed25b00ea3186fd711d1bd569eb46fbab8d2bd94fcd8c24a8f8263a51bd85109040d93da107

Download Submit