ce19e83dbfcffc138cdcd8fdb37aa36f94d072fdebb85365ed982aa3080e69e9

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7001d73fb4c618b17d24c56f0529f980N.pdf
Size

108KB
MD5

7001d73fb4c618b17d24c56f0529f980
SHA1

899097c5f543e3122627213c7fe5c1bfccc0bcf1
SHA256

ce19e83dbfcffc138cdcd8fdb37aa36f94d072fdebb85365ed982aa3080e69e9
SHA512

cb15e42f3ff8d7a10a4dd399878f5a7fa758cf0d16fc61ba17a5b283ed2f9bb90ed7fd9f0e39073783f39dd2398d06cd604635cc3393efbcf8cb78bcd56d1d9b
SSDEEP

3072:a7IklvnAvqMIapYzEPyFQW96pGviP6CfMmJdb+Yt:a8klvAi8sELW6OS6ChS+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2636	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2636	AcroRd32.exe
2636	AcroRd32.exe
2636	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7001d73fb4c618b17d24c56f0529f980N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cb85d0dd0c5363d54b07e9fa768d7f4a

SHA1
da9baaa13b79f8c64ba61a5237250627e80e0873

SHA256
be2951f24ae13935badc4ac41c49bcc571a7e0f10ede5e86eceb6d811d7ae5d1

SHA512
19f4ed6a9ad04adb30991633999816a38025ff4bd5894757dc129354fd422ba9755dad5dfe1f5a275bc7cf4e8b76f6e7ad1d736ae7e00b6825b7255ce41e2d04

Download Submit