5ea6744aec04c8daea5690b5aa002fad09f7060ddd9f1fc16acdff0b7d13db91

Analysis

max time kernel
95s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04e32dc7d8036bf7723fe1d48271da40N.pdf
Size

514KB
MD5

04e32dc7d8036bf7723fe1d48271da40
SHA1

58692ca43b999bc0b4ac2e1c1df36d24f862c4e4
SHA256

5ea6744aec04c8daea5690b5aa002fad09f7060ddd9f1fc16acdff0b7d13db91
SHA512

dbdecee1862e0ace5fd277a66cdde038ed7208f1c5601e3f39ab76ad27bcbd8ab8afda86da8060c4b8aca777f2d7a0398a74b2ab117d93e535cb72938beb6f27
SSDEEP

12288:oEu4YQBx/WvfAQfi2K08hmA+xw2RUkgCtiahfjdai:YiBx/WQQ408hjuKkgDurdT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2388	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\04e32dc7d8036bf7723fe1d48271da40N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
af5f083aa5ddfbfd6f531cd38a676b66

SHA1
8abd6cc42404c2c5daa1828d30a0f9fc4fa77072

SHA256
42dc1b44216428342f8257bd179565386a0f2c661d4094c398901e7dff6b0726

SHA512
a8e3444aba1d8498100073011d72d306dbd981f4aca61b73bda495bd49c979dca2b3a94fe884dd960b965f0cb7c5b1e3508456c6d75d0491eaf00c26bf48657d

Download Submit