aa341fba17216918f9b16a4b9776e8ab823c419c9949d290ab7103257a02ee09

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aa341fba17216918f9b16a4b9776e8ab823c419c9949d290ab7103257a02ee09.pdf
Size

1.2MB
MD5

0d46f6a4c2de1197e4bf826a66494cc9
SHA1

13bf83724e8b013eae5c0e622ea3b29da28a93bc
SHA256

aa341fba17216918f9b16a4b9776e8ab823c419c9949d290ab7103257a02ee09
SHA512

741f209a48a6eaf20d094ba644aeaba52b3efdadaabda73726951adc555e49d887c0156ded6c9afafdae55c8e3ce8d7aa514637c7a6b650778121a47903b7da6
SSDEEP

24576:hupgOeGGu6SHgYpYI1Uq0R7h63QeaO6zHG7D0SXcQVhyNAvFm1:2e66PYp91Uq0xBe76zHy0QcQUA9o

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1756	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1756	AcroRd32.exe
1756	AcroRd32.exe
1756	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\aa341fba17216918f9b16a4b9776e8ab823c419c9949d290ab7103257a02ee09.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a6a748600770f0331e1107a59518dd58

SHA1
02dcd3ac81a703a889b70ad8254b52a92d722053

SHA256
3f2b9dd9bd587f980f7652c9c647f1cb859bcc155eb81c5fd3e0d32f378fc74d

SHA512
3ad5a729241b3ba911f9cf022980277c199b59d8d7a5a279fb268064eb3c61dce1d1615cf71f0b4314e58d3d10caee2bbf6ac325e2450adc9968aad87614b3e7

Download Submit