85e41c614549a9d1f0c4342b802bab71acea9c44bddb72ae859427d55c976c1f

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

metric.pdf
Size

280KB
MD5

20611f9d86d10408e4960638e927f3d1
SHA1

4288b1c61b41f10d1f6ac99df530b71ab83bbc1f
SHA256

42ca2324c7b955854cea9b197b213030aaab5981d52f7d075480e8eaf6be4652
SHA512

1c26c8d03ecb91f1fd6b2641f58d2a54d6e26ac2121259ef7f12db335fc1a12184ce9daa3dc2d6cd4b3c8b933b1a6e5dda781eaf11ced9e2f96f375b76e84ae2
SSDEEP

6144:8N+hzU5ZBJ3yePUQPvrVbb4bOrnMXY53fE1X0eurhwf+uapAkV8gvcw2NfZu:8N+po3yesQPTZbwOrMXYJEx0Jrhwf+jr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2664	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2664	AcroRd32.exe
2664	AcroRd32.exe
2664	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\metric.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5a23b6535e561ab7aa1a7924a692ee04

SHA1
2d8643488d34f365bff4e9c2ab61d4742c469794

SHA256
994974378973b9907731353caebd85135e85e41231d373673fda5b28f6a76258

SHA512
52122fa4bd9b69cdb10c7a4dc07413369cce2fc88b330e3b1ffaf45c71598c83ed000cfb33f400cdd287018147b2d0f0c74c8d1081a6c4027b59b3fb0bc976c9

Download Submit