5b7698ac2d946a4fe7f4c8daafec79b3433b09da9be05b7675e4a13a442cb5ec

Analysis

max time kernel
94s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33259b9d35f87cd18ba001a77976ff70N.pdf
Size

538KB
MD5

33259b9d35f87cd18ba001a77976ff70
SHA1

c5664a6b648cfa9c694bf36f567864417de9600c
SHA256

5b7698ac2d946a4fe7f4c8daafec79b3433b09da9be05b7675e4a13a442cb5ec
SHA512

fd174123cecc20eed2067b02b7946d9066c4c3a79938eb52d59a7cfa195b67ec83a639000faae0cd5f344a754994a8f7a4f082c410d057585ca3a74ca51cfece
SSDEEP

12288:KC7XXOuDM/G/5ZG4DGlgdhVLZj7uJtaufUM69n6i3j:f7nOuDf/rpX7VLZj7uJJsM69n6mj

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1732	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1732	AcroRd32.exe
1732	AcroRd32.exe
1732	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\33259b9d35f87cd18ba001a77976ff70N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5b732ab6fea3a8da7e6a7e501a53ca59

SHA1
dcfc1350d2bb872729426cf0f7f563b3d58ed706

SHA256
2bf100ea7a9285bbbd4389c9df52a3c46d70bd9e98e4cd9f33ee6da5b4e76809

SHA512
5efaf76b8bbdfcf8da83eefd88a325d7b2d99429e94ce17b4a871dcfa60a022719afe05ca158e6143c3d4bac8797fff6346cda7b15d89bbdbc63bbcdeb848e19

Download Submit