594c2a8dd86f6fb443d83bef69c41854516ad44654e20e0e2ffc84333ea96b09

Analysis

max time kernel
94s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

34123353dd612ffd3bcab8cb58bf54d0N.pdf
Size

1.8MB
MD5

34123353dd612ffd3bcab8cb58bf54d0
SHA1

0d804883422923659af6d125d5997d78d57a7f19
SHA256

594c2a8dd86f6fb443d83bef69c41854516ad44654e20e0e2ffc84333ea96b09
SHA512

840c6bb3198d1277b9229b5bd0605d23b88019bfaa7d54b7fd24ebe732806776b2bf5419bc2376bf729fd9279fd59c16ac9ad15a58067d91c7241f2175f17de8
SSDEEP

49152:EASs0zxe05sO+SYNgLIF5YsRRlFD9QiVSZ8jjK5Bn:z0R+OSNXF5PfhVhjjK5p

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2824	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2824	AcroRd32.exe
2824	AcroRd32.exe
2824	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\34123353dd612ffd3bcab8cb58bf54d0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
488040184fd3ba699dbd8ea4ced263ca

SHA1
fc8d8e0c63153e53af3aed28c670d8b869cf691a

SHA256
e8f98e81646c18ac95a034141406b3c07796b7015471589c0af13e443a9a9aef

SHA512
a72dbdeaaf60f887e54649be213a628b9ed2cdd8cdf6c069362549770746ed0107cb2598e458366ea1804ee8e9de6daf8e4941a3e87d7aa825e6085dd6090756

Download Submit