26454ef170ac681331a351d504114eb06370a0f9da5661e1f2e2c4c6b2180937

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26454ef170ac681331a351d504114eb06370a0f9da5661e1f2e2c4c6b2180937.pdf
Size

131KB
MD5

749945bd1781b1ecc42d0612a408a6ec
SHA1

54989cfa5a4ad07e094eee62f2a7edc7465f8764
SHA256

26454ef170ac681331a351d504114eb06370a0f9da5661e1f2e2c4c6b2180937
SHA512

2e1007ffe5eb544bea4730b27ff569dcf1d04183611e88ddef22754bd45cba1c155cb0ab744b0da28011ac001a47bde4a60dcb759703e246092a0a6314d992d7
SSDEEP

3072:Sdei56CLq0wahjnvBmH7mgWjZmf7Q+oKP:SdeXHKjnvB+mSf7noKP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1856	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1856	AcroRd32.exe
1856	AcroRd32.exe
1856	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\26454ef170ac681331a351d504114eb06370a0f9da5661e1f2e2c4c6b2180937.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b1f78c3c2badc419edd99116cae05538

SHA1
5c4a279202aa8c6f64635fa91485eefe58496424

SHA256
b00c543cd741897d24a838c87ff043afcfe9fe1a4778470b26e6ce1247589290

SHA512
3f5227308677324c7c012516971f3afce850faffead40a0b70b5efb50e4c77e2660cd9dc2ee9d15c02e516774085e3e53ef343ae78527a7702d9ac13b9ec6ebb

Download Submit