197def50bbc275ee3ef925fc9113ed44ac9deb6deb8875ab687009cf0b5d7095

Analysis

max time kernel
92s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 21:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

test9.pdf
Size

1KB
MD5

8e71dc30a3619aaaa50b28354115fa24
SHA1

f467dcb96d9b4d7e8bd5000e3fe7bd5325fe091f
SHA256

197def50bbc275ee3ef925fc9113ed44ac9deb6deb8875ab687009cf0b5d7095
SHA512

beebedf0161aeb9454911632f1e44ce642f242f780f9ef7352cbdc8420ecb8750c58efd80fcfaa79d712c55cb1b5d44f3ae62d9285acc63510f8ecea56c76181

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2568	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2568	AcroRd32.exe
2568	AcroRd32.exe
2568	AcroRd32.exe
2568	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\test9.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f13792218ae7e0b6f94131d79bc8a183

SHA1
9ca7307936152f21a82bf8dd0ad20e27ba09891b

SHA256
0c5660ee2ec1d6d207d5f27a51a0110c12fc5a89e10c3761d529a781233ca74d

SHA512
60c45d763ecc2cc587aa548d7d6a09a812a5cf7cbb36d2bf401286cffa2ebbc3ba6ac46dba1f8b3d5e1d52b28ad4ce2c60cf65f9b85c61b2c7f4461eb2b7792e

Download Submit