83c9d9066e514415f6ecf2693b8ccb3b1794e04761d215a0daa54d4369d6fba0

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 06:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9523b5f4aac4e809201b10d117fdc250N.pdf
Size

297KB
MD5

9523b5f4aac4e809201b10d117fdc250
SHA1

92698fc3b13b1c21203fc616c56a1fbc4a3deb78
SHA256

83c9d9066e514415f6ecf2693b8ccb3b1794e04761d215a0daa54d4369d6fba0
SHA512

d309db21a5f95826a83063e2a69d333b4ab44b387a7aad85ffecea83d271f79825d0e0ea4a7299fbb209002f7b18fc88431cef92a2a8a5bf2982536f23fa6751
SSDEEP

3072:i0jIkUNVb3M3TNw35DCemodlOGTqp4PzRTY1TiU3o3DNIg3N+JuWr/D:iKUNR3M352JdXG+bRiOUEt3N+JDjD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2152	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2152	AcroRd32.exe
2152	AcroRd32.exe
2152	AcroRd32.exe
2152	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\9523b5f4aac4e809201b10d117fdc250N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d5aff5ffc2c79200f81454e2cef2dc80

SHA1
6d243a1d4242039a46927fd6382057193692353e

SHA256
c7fd03b7fdb91ecbeb3b4c3e1fcbf2cbf09458daf328b0e79044462ef82067dc

SHA512
300f748e63f4481166ddd8b7447c86e61253c5fd642e6b2671368ef61e6df9723096a930f831d5e77d3c3eee7366a802885b887974d23c586681fe4e98857825

Download Submit