7c57da953ec816337ab33f5ece5a1e30bb52810feba29b0f9a6ff4d80967da6d

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

056010c301dcb25db910e11e9ce9cf90N.pdf
Size

306KB
MD5

056010c301dcb25db910e11e9ce9cf90
SHA1

57589a5937eb56f74e0f37b2d266995ea64b6b99
SHA256

7c57da953ec816337ab33f5ece5a1e30bb52810feba29b0f9a6ff4d80967da6d
SHA512

09297c6ee560b01bdcc18d4fee01ce2a5bc6e3bcc635b6a71d6626b9ebdf8b29912c78767f109cb7b8b5e61bd3981dcb63c86c9be701a0518d9e917314681653
SSDEEP

3072:4v0jIkUqVb3M3TNwQ5DCemoCaOGTqp4PzRTY1TiU3o3DNIg3N+JuWrSN:iKUqR3M35XJd5G+bRiOUEt3N+JD2N

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2332	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2332	AcroRd32.exe
2332	AcroRd32.exe
2332	AcroRd32.exe
2332	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\056010c301dcb25db910e11e9ce9cf90N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9c035920a2631f79b51d4c5e13b72887

SHA1
d334369f7fdaf260fe11e6e54e04179a6fd9ccdc

SHA256
4f0edec77464cfe548b89caf6b7c9001a6302d6169f4564f988e9fb93f88c3f9

SHA512
b5c7a582f0ec65391717e16167c503a60b26a90451505c982b113af04f3f01fcb5890e188fae1067acc34fcbc05d2d7ed83b2a725fc00eed02e67b5d03eeb8fb

Download Submit