79b3dccd4b3fa713667d86baf6d6daecba110d12ea17ecbd9cbaaa872e20bdcb

Analysis

max time kernel
94s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3cc1f977a6b070dc75391824379c90d0N.pdf
Size

124KB
MD5

3cc1f977a6b070dc75391824379c90d0
SHA1

a6011ce7100298cfa9d1327eddbd560dfd4a6175
SHA256

79b3dccd4b3fa713667d86baf6d6daecba110d12ea17ecbd9cbaaa872e20bdcb
SHA512

2d641422d555f508fa93598faf687ba5ce8ab2ff50b8b43f6d4ceab7519d4195f6c4759668cf3c05ccd6d0cd255d02b2600a07059a76768411a88033f246d945
SSDEEP

1536:sJme5HHjmwip4JjiNQ8R5J6NONq0M4LSjbDaZ6PEHXxv2OWvLqShQr6uX/WQomM8:NSmZpk+MNONejbDu6MBv5kLhuO6cM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2120	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2120	AcroRd32.exe
2120	AcroRd32.exe
2120	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3cc1f977a6b070dc75391824379c90d0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4f889961bcb49e93bf4e805fd741a8aa

SHA1
c4014c97637fb0467e485973ef275700186e768a

SHA256
69fb680f32cb79974a575acd69fb6f01acf903cd2fb90d5f55e40c97e4729657

SHA512
e830e6bbd2ec681527ed75304140d5aec020d354791dc438f6f05d9f08c1c1df2911069212b4f56cec9a4edfd697df1719e281e77e8ffe0013d3a6821d4d9473

Download Submit