7fe893b4f397561cb66e5bd35bda5a743e35f6c3ef925f49a30fd318fb7f38c3

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2a945c71d9bc233eff83e71503611bc0N.pdf
Size

76KB
MD5

2a945c71d9bc233eff83e71503611bc0
SHA1

0b2c5c084d7d271215777c30f7ba3172f5d5421a
SHA256

7fe893b4f397561cb66e5bd35bda5a743e35f6c3ef925f49a30fd318fb7f38c3
SHA512

feaba89439c7001cf43ebf37e5f2dde2ed3584566864fd1f8969cda63e897adf5328a16507091cf19e482f91f811d8e5dd181eae2bc056e3a346034d0b474358
SSDEEP

1536:WRaJ9Mt2RDIxNvWymB/6oCeCGadm6gwHzMu6MkeJSc:yy4OE0BdWMwHzHbkez

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2692	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2692	AcroRd32.exe
2692	AcroRd32.exe
2692	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2a945c71d9bc233eff83e71503611bc0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
62e8140d97e51cd6939b6e90e311487f

SHA1
b60468cf4aa2a54a0615022f351ac70a81a9d24c

SHA256
214723008fe2720e7d01226de22a9fc1cc3a26c2e67ac7bf0f9c11f37efdbfb8

SHA512
449544850a69de8c7eb0fb25370065295b287afce8824e8805361cfd815461fe27c61c7add0796c76ca43fe224af90aeedde1c32206cb1683eb848661ab5d305

Download Submit