a215e502f24420e8cfcd5b0d6fa2115c155f95fa33852bf4000d47fbc423f870

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cc1034f1372dc0f67f531d310659fd0N.pdf
Size

72KB
MD5

2cc1034f1372dc0f67f531d310659fd0
SHA1

ac8dad038cae84bd22409cf9e09bd6c764113250
SHA256

a215e502f24420e8cfcd5b0d6fa2115c155f95fa33852bf4000d47fbc423f870
SHA512

5df8f7fada0fbad0854b5166d739d3e03ff67872a3e0e91aeffd99d5f649227614720e425027a2fcee866dd3944a9a63b3ba84327c299cf05464bb5d503eeb74
SSDEEP

1536:QHCHqOp3JqCzMCogNjMlTcn0wEg23JjwaE0K5tn/CkRh:cWqO+4ogjnfN2Z7E0K5tn/CE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2528	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2528	AcroRd32.exe
2528	AcroRd32.exe
2528	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2cc1034f1372dc0f67f531d310659fd0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e0fef3e46e415fe1030cd9295901d8e4

SHA1
7e700f1b0d145db81f25e708ca0890d6c514c12a

SHA256
0d46097128f390e3e5acd59c3837b778c872c6affb6617d14287e53065cf09b0

SHA512
b0ca7879d8c516ccac59dfa91f868b7b2676bfb9ef233516cacc4693067fecf3349b0ae03827a7108629f4a345384afc2c87a2763d9995b2d023e78807ca71eb

Download Submit