a2db1e351d3b9818807cb89d105c1c979523a5d9a31c0e4952b7e52624500cdd

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 11:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ed911fc11a4fca0c28f0812cff9d840N.pdf
Size

301KB
MD5

9ed911fc11a4fca0c28f0812cff9d840
SHA1

73c7bfde49268445317091d90a027d1dde2a4e77
SHA256

a2db1e351d3b9818807cb89d105c1c979523a5d9a31c0e4952b7e52624500cdd
SHA512

064eced3334855b3a76747057342fe66bc04631d86873ff0ec6f2f486bb378c08240a490fb5470b2f8259166140b2fa9f2c18cc8ff193e61084102f8ca676fae
SSDEEP

6144:JwGYtEdMs0+zzKNqikm+EiqvXiGjbLGYb3pdtH7b4/KlVkn5G3JI578LtyWZJAwH:h0AzKNqIvX3iYb5HY/hoi54xyWnvCQ/9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2820	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\9ed911fc11a4fca0c28f0812cff9d840N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e3856c1ffd4171d491da9e88b2d18697

SHA1
9ea816e9f5b0f1a7227399009bdd766ae3644b1a

SHA256
6c030076223a12d523ffbe45b7be50c05dd4a0045d0ee5670584b957ec079a1a

SHA512
0f2b6316daff6ec9d592686cca9ac2af5403604d8e21736e4dba7b4f7725a1115f3bddda2258776fbd91dad6107227549a16702bb3aa86d0769029deb6c00541

Download Submit