90ced6d7cf57a5709db8df6eb959238ac58a1ba875165913c2f3249ecea716d1

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4636f4b7539570235e30b4aa85be14e0N.pdf
Size

565KB
MD5

4636f4b7539570235e30b4aa85be14e0
SHA1

b9df69780f92c0516e24251a3bc71686aba5991f
SHA256

90ced6d7cf57a5709db8df6eb959238ac58a1ba875165913c2f3249ecea716d1
SHA512

810698b76787d23453b6b8720b5e592c0582c1aaf3e1cc159b9fcd2598906f0c89a0cdc6e26b973f5ed2823fd53a5c4fdaeaaa4b638e72d3e3a86d1948d37c5c
SSDEEP

12288:nav7ltUpIzyW5myYNvNUZoveAopc/q/kJZjGwteX0daaPwbYSSdnn3am:MU0yWMQ2eAopcy/k/jL9d/3am

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2392	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2392	AcroRd32.exe
2392	AcroRd32.exe
2392	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4636f4b7539570235e30b4aa85be14e0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
71dadc9c0afc837e9ec1641b31b2aef1

SHA1
42806ee06e5ec55b057e78d4d94259f19e17c474

SHA256
f1272ed9d3a0476ee7311429ac5b67895dfe9d5e909a9acb94e701057e1190b1

SHA512
012716eb8821873c2555b37acfcb5ef3dbcdb1f208d4b5e514bc2c8ac38f481016e206ac839c5b45f8edc0ed33f578e4f9781b17818533f9e9b3a23bd2d9aa27

Download Submit