bc3cb3db93ae7ce64fa097e3802e286fc8d518bba2ef9e3fc5049db0b16b8be5

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25dc5c5d93207db2d75fe07b00496320N.pdf
Size

322KB
MD5

25dc5c5d93207db2d75fe07b00496320
SHA1

13befe3dd310e2c031b1dbc7510e140f8cb52119
SHA256

bc3cb3db93ae7ce64fa097e3802e286fc8d518bba2ef9e3fc5049db0b16b8be5
SHA512

de18ed9e5b72c8ad16a4060b68b75690aed3e133b0d8eeb41f840b3be9b1e5639e42e4a47ac2f2550ab4976fa33b0df669fcadeaf4f4a25ab6ced9f9fa96a354
SSDEEP

3072:20jIkU1Vb3M3TNwv5DCemo66S2nbkU+EgoQc4EElFG9oaPgF2TH3z/ts2gbtCsXz:2KU1R3M35YJdpbmgbgFMz/q2y4FHsL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1752	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1752	AcroRd32.exe
1752	AcroRd32.exe
1752	AcroRd32.exe
1752	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\25dc5c5d93207db2d75fe07b00496320N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4c0dcb9cf42a9f088f15bb9a9571ea99

SHA1
9eed6168bd18f033c4adf2c3ffe99710cd727ca7

SHA256
2464ea01eda07e153d02d67d859e0faac581a7ae8ff424e76338b1a841243199

SHA512
f01d59bdb032d59a4addc6d46e7248c157df0a5562e857fabeb587cfc35e046548fd5666b24b7453749659f785c9eda177e94e728bc2623613f2bf8a9b95f696

Download Submit