335e998e0558577eacdf448d810229e196364bd562e5dd75055dc216ccc6229f

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aebac18cfc24be9a2ca30ba18b37162cbeb78cc056a79c0cd159851736ef42cf.pdf
Size

153KB
MD5

a829c233af21dcbba7a8f3d5e5f0e937
SHA1

a3e5f36a6c6aa8d153a311c66de474a8b21a6684
SHA256

aebac18cfc24be9a2ca30ba18b37162cbeb78cc056a79c0cd159851736ef42cf
SHA512

134dc6ba20dcd167a09d2ea772a9ef0fec4587df8f2696a93f4c7fdd9e16c243651c0e710a4fa48bb4c62d05baa26709af00c352b50d28856ee4826d6b257de9
SSDEEP

3072:VTySNp0OuTc4PRxOK/MNs4AsyBi7H90yrBAyhYMs5VrZTr:/pjEPREAM7DAi7H90yrBPixx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2572	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2572	AcroRd32.exe
2572	AcroRd32.exe
2572	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\aebac18cfc24be9a2ca30ba18b37162cbeb78cc056a79c0cd159851736ef42cf.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
dac478c51014c50ea3fc8b52ac8f3764

SHA1
508bf3c3a62fcd1c5cb47f86f906820dc5bef89c

SHA256
24cf52fd67e566e86d49f7f255b3211d96c3142062a3dcf3f27f2dd52d7fc372

SHA512
39b74eb6185b0ae740467fc877a13519678b6c1dfa5fe6f0fc71226c1f098a3853cd7ca00bc2df3fe954311156e7052dc88e2b46f41665845828401ae9e8040b

Download Submit