aebac18cfc24be9a2ca30ba18b37162cbeb78cc056a79c0cd159851736ef42cf

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.pdf
Size

153KB
MD5

a829c233af21dcbba7a8f3d5e5f0e937
SHA1

a3e5f36a6c6aa8d153a311c66de474a8b21a6684
SHA256

aebac18cfc24be9a2ca30ba18b37162cbeb78cc056a79c0cd159851736ef42cf
SHA512

134dc6ba20dcd167a09d2ea772a9ef0fec4587df8f2696a93f4c7fdd9e16c243651c0e710a4fa48bb4c62d05baa26709af00c352b50d28856ee4826d6b257de9
SSDEEP

3072:VTySNp0OuTc4PRxOK/MNs4AsyBi7H90yrBAyhYMs5VrZTr:/pjEPREAM7DAi7H90yrBPixx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2320	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2320	AcroRd32.exe
2320	AcroRd32.exe
2320	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\file.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b92d5f49c1f156de648be158e8b072f3

SHA1
5287c908123e41eec5c02c772b924929e0d865ec

SHA256
10b4de4b35f08870d449f8e790fe7c0aad6043f20fc446ecb984f0ef2600bfc4

SHA512
b3f6d8364ee2d23b499df8a32b93eeb2e22707ae24653c62bb18a6247533055d0b5a2af7bc321d0c48765c9b3bc9a2c773ab4a21b6215612d4343021d09f1fca

Download Submit