2ecac40b9d6e99115bde1cc4d59913eaee1b06a6d1d8dc062b0263654e159512

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6f8a8ceb1ecd088b63aa2d264730190N.pdf
Size

33KB
MD5

a6f8a8ceb1ecd088b63aa2d264730190
SHA1

bb913a65475e9f32b41e8638056acd8ebb89e1a7
SHA256

2ecac40b9d6e99115bde1cc4d59913eaee1b06a6d1d8dc062b0263654e159512
SHA512

592edef98dd1480183cb03313c9ddfb8ed2f0de3361fd17083195dbbc97fd3c6392b5679690a3f1295f71949199069802ddee34333a060e24ac4a9177700ec52
SSDEEP

384:hUJuG5KTU3REP6jtQrqz+iwiTVvfOwDPeRsegpZYv86dZj5xFmv9VY1cJOe:kuC73RiMAitRvel0Yv86dXxMvM1cJv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2244	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2244	AcroRd32.exe
2244	AcroRd32.exe
2244	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a6f8a8ceb1ecd088b63aa2d264730190N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4c61edaa91f747d22089cab173718c0c

SHA1
f02a0493701575457aecd08fc6f1c97ddb00cd6c

SHA256
1353ece00ff38762da40a5e5725627d8dd9fb9aceb264cb580aa484fabda65ea

SHA512
f5fbde7be1dead6ee1acc8aa32fae5ddddbd26f312a3c66db8ddc0665acd56918dbb9d92dd940acb9dd77432bd0ef0c6c100d61ac0643d8326364c50827b6eca

Download Submit