256fcacc98ff6e3485e2da831eee2f96bdc39a67fe9897459cbd08dfbb8f58bf

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e8a1bc8e78f47ab32cb31a120caca50N.pdf
Size

181KB
MD5

0e8a1bc8e78f47ab32cb31a120caca50
SHA1

336eb1ba05af6c5be8f00ba44e4a69ba644e9989
SHA256

256fcacc98ff6e3485e2da831eee2f96bdc39a67fe9897459cbd08dfbb8f58bf
SHA512

40737a15eef2eaa6aa08a3535d456f89c1db246714b40a7207e2d99235fee0e79fd380b7d013f560c0885cf78d4eb817dff3e67ae64795a5371431332e50ee26
SSDEEP

3072:wyeUesWCbRGMWGcMrclN1/znnOSPybTJC1JUgI5+BKDxVfNR6za/tx5Ti2Z7OYIJ:L6sJbsQMpbOAuJCUb5+ODVIapmAvM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2132	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0e8a1bc8e78f47ab32cb31a120caca50N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
558e9fdb4bcd783f6ff2d676c202d14a

SHA1
90037fd9407909ea84286fdc74c7d8b9dee5bebc

SHA256
8e0e6bbbf5410f7753d28c4b1f4931211246677ad15f4c7db1fc720ef3737cc6

SHA512
fcceb80964f087640d50f4793768538f7aec3fe2ebb641d11a5651f5be1b2800ee6b2be0d99a8e5fb05eb7944226455e80bf0c13c8f3bf166d991101994bdbe1

Download Submit