329125fd1d5a52605cc7c1905b71532a2e6797197c28a9df146a2c0589597eaa

Analysis

max time kernel
94s
max time network
20s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

430d4fa2053885564afcbfa592066780N.pdf
Size

112KB
MD5

430d4fa2053885564afcbfa592066780
SHA1

6f9d030156dca642098171c2be15ffe260ee311f
SHA256

329125fd1d5a52605cc7c1905b71532a2e6797197c28a9df146a2c0589597eaa
SHA512

2510f01254924627a7c4ff73244d69428dd4bcf51989ba70fa7c4b18710a59a91b9445813beb8ae543864f4b6d1865b584c3e92668e2d271f515612ec2a11e0f
SSDEEP

1536:XVScR1CF0eIO8r2eRokqGD2skh0nxxLgk+m61cwZzfULTODLWy04mJRbYjMjQGkt:XgcR1iyvektDNVZwZg4mvbG+QGkt

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2772	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2772	AcroRd32.exe
2772	AcroRd32.exe
2772	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\430d4fa2053885564afcbfa592066780N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
87d44267dc4885856fc76432761eeecc

SHA1
15f0e2f81ca10a6d6938c563a8d52733379a85ce

SHA256
ec5e15dbe0e41841c08de30106e63692aefcc4d421c386253c6b52388a130a8d

SHA512
08980eb46ffa1054493d980211e09ba7d813f55e6b8b46d924c80b1ac535a081f896729ce93572cfca869590a6d17241f8bbc905c3881acfaa06b5e10268e976

Download Submit