29742d2fe24be1eac24e35f427e1f30641279480fb4a64ff68ed72dffb686613

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76fcc7e9210446cc3f89c7bb303e09d0N.pdf
Size

152KB
MD5

76fcc7e9210446cc3f89c7bb303e09d0
SHA1

d8e882feb4b4a4e78889853a1e9f0afaa74dcbbf
SHA256

29742d2fe24be1eac24e35f427e1f30641279480fb4a64ff68ed72dffb686613
SHA512

bbba1fd85da51a2b6ec5d7c9d44d320f05602bed2dbdef1fe9e4d41fc5ae54538da4e0c6034bca7e1dc5ed081cfab327a6df4208465f41a608161f096e179e6a
SSDEEP

3072:14Yi56CLq0wahjnvBmH7mgWjZmf7Q+oK0665aYD4BMNfeVo:yYXHKjnvB+mSf7nonYKfeC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1544	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1544	AcroRd32.exe
1544	AcroRd32.exe
1544	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\76fcc7e9210446cc3f89c7bb303e09d0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
524b6c188285f1977237b2f5571a9f71

SHA1
292c678e1a9a9c4733fa458e37d4f65eb077a41a

SHA256
2c935f2488403b516a30240f4b548fb1f75b343806584596932fd301ee5c34c8

SHA512
1e99d5b0b973f70767f7f6dde88a05914e73d7c711ccba008bf199abe90368f6f65b9ea6ad70b676a04808c048b5d500ffc9a45e41af777b0a0e831e9777d905

Download Submit