a6a2bce12527aaca02521b2159e0cba1e60e4d0fe87dc69e8337d18007f349b8

Analysis

max time kernel
90s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4331ae45685545e5bbfa19f9b4f391d0N.pdf
Size

585KB
MD5

4331ae45685545e5bbfa19f9b4f391d0
SHA1

5cc7b6c986ac6ef514e2c32f0ecef6ebc86f152a
SHA256

a6a2bce12527aaca02521b2159e0cba1e60e4d0fe87dc69e8337d18007f349b8
SHA512

f983789850f6e3897cecabed13298fe562b35a795611265fb8a4f15847d83df4a29b30364eb26d35762c6c953aba021a84616ac28e0d2081ca24ec005344d6b6
SSDEEP

12288:sLc+9dr8i5OH3ZZ0PidJQg4lySohPCg6VOCsli1q/b:sY+9PyZOPOp6vCIVOdMob

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2116	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2116	AcroRd32.exe
2116	AcroRd32.exe
2116	AcroRd32.exe
2116	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4331ae45685545e5bbfa19f9b4f391d0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3330a39b35f7e36e53189b05ab19705b

SHA1
59b8a32b11502c6d5dce0e9634daff9f06e95425

SHA256
983887b0f128beb5fb0a779bf0ba14905fc9a9134b306729954425155ccd5333

SHA512
1a164797b107b48f7f96c33664d915291d4c6f49bf39b3cba24d897a27547c6a4d66981c8d2744ac15b117be07646c87b088f9a68d3ce304872cd476579066ad

Download Submit