073c72fb0340c6be825ae0775d724ed5eda3ca6c59c4f0990e73fb4bd08e07d4

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b390eb3a36e7702e494951d081c37020N.pdf
Size

166KB
MD5

b390eb3a36e7702e494951d081c37020
SHA1

d6263e8ef802276cecb05b75ea4528351298a9f2
SHA256

073c72fb0340c6be825ae0775d724ed5eda3ca6c59c4f0990e73fb4bd08e07d4
SHA512

1cc45e5605a9dac0f056087806a92c655b3a380e86c40c369ed3b9065912191ac9319928b40613d03a348354cfc6ffe0237819593d002de698ab5d17c7044c02
SSDEEP

3072:jRMAekAi56CLq04ahjnvBmH7mHjZmfHQ+o7E3id08QXZafkU:dMA3AXfKjnvB+mUfHno7JH8U

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2160	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2160	AcroRd32.exe
2160	AcroRd32.exe
2160	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b390eb3a36e7702e494951d081c37020N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
059b35448b67853a0c9cc27c06203cf7

SHA1
2745e14af30a0320aec8c78ba44b8f156017ae94

SHA256
be41b76490f0f8842860135d4a93428f8eaa829edcf3e047822be50f9a39f69b

SHA512
295440f929d3be0ec616e15824c79c3b94587819dc814f3301f471b309983db42631e624ee2bb1df8f10f6ecb032837149ca9c59ee780c2f1bef0c73918a7c2b

Download Submit