6ce506bfe130408fbcec9ffb3e0ce8171fe44e37788abe3f0e3a52c0b218c95a

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a78bb9bacce56a0b4985728f853605c0N.pdf
Size

94KB
MD5

a78bb9bacce56a0b4985728f853605c0
SHA1

1f4f1fee98491df1bf9ee6786280805540834723
SHA256

6ce506bfe130408fbcec9ffb3e0ce8171fe44e37788abe3f0e3a52c0b218c95a
SHA512

36fa0a93d643d2a682b27919ab4cb26e00e19abf61611db36a121c81bddbb197040c9c1cc675ba2c8412260bf989837cd01ccc5f698569d97c3e213845709dd4
SSDEEP

1536:FrJzP1ES8QeC/XKeDgIUXn2Bv6fD5nTyNGq1EPRw85kT7OIfZHbIM/jEtdBG009G:JlP+S8QL/XKekI82BgZez1EpwukHHLgP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2240	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2240	AcroRd32.exe
2240	AcroRd32.exe
2240	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a78bb9bacce56a0b4985728f853605c0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bee67d1551021d5c632e40659c43c2ce

SHA1
9a4da67e53c7f505204953910c5e11ac7d96357e

SHA256
3f579559a0be249b89a0aa8539824e810873d876ce64b61d9ee44ef17d756168

SHA512
2f570dc0dde33fcfabc5370c9516fd0797c7dae701f11abd82f1337a40c01c1bb28a104b77923003761bc31c0fea0165c2143dedce7cbb6b6cba38123c9c2204

Download Submit