11af62c9993467c1e6d4a159b3c60e8b1340b445cb2ca81c254c77777eba6f3b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae76f3968e124581ce5724b28c0f2470N.pdf
Size

623KB
MD5

ae76f3968e124581ce5724b28c0f2470
SHA1

5b8be3752af6d647b6d88048a23284576b7f8921
SHA256

11af62c9993467c1e6d4a159b3c60e8b1340b445cb2ca81c254c77777eba6f3b
SHA512

5d6c3b6960075f00c8409f8fc8837d2c6e0f01002c5c30d76682f0a09e593d9fa74949219ee031091c8c4e0668a1f5e1669451bae8cc40bf75b021aff26c44fa
SSDEEP

12288:8L31t0OBlAVjU/FXOPprrq7V+sM131ZgQTKcfr34:u0z4t4Zra+sMR1D34

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe
2720	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ae76f3968e124581ce5724b28c0f2470N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f2f560adce94eb973a79cc187b72683b

SHA1
3955b3282c3f0b29dcd95d699e3f5b37b036e02f

SHA256
3c3311d4472cfe56532de0c3edfc00ca854c012ca70b6f60012351fd818437bd

SHA512
519ae304815debf2e6c35ab74229340b996c4a5d763e3e6be95c7100479f2920f0ff953c3f5389e42bb63b09255e07f2c3181f5b2394ca1601aaa7b779562072

Download Submit