00301d7ee541b3840fdeecf6fa755b355bc6a0a8f8ec95c973b9c0f08df514d7

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

393ebb518d7da1f5664ab1f30dfff1a0N.pdf
Size

143KB
MD5

393ebb518d7da1f5664ab1f30dfff1a0
SHA1

b2e2db1452bf469020fdc12e8fb66bf9a93f0625
SHA256

00301d7ee541b3840fdeecf6fa755b355bc6a0a8f8ec95c973b9c0f08df514d7
SHA512

80b9d2dbed218a8d12d3050c95a7c2c584f265657c893c26d3005c5f629205a29cce72e30548339ade803ccc8220f5a86ab2b03a5786034099abb14e047b489b
SSDEEP

3072:CRi56CLq0yahjnvBmH7mHSjZmfjQ+oc+yCGlrSV:GXBKjnvB+m/fjnocEGq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1948	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1948	AcroRd32.exe
1948	AcroRd32.exe
1948	AcroRd32.exe
1948	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\393ebb518d7da1f5664ab1f30dfff1a0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ff0f04b25df716e80f8d1e1ed925a2da

SHA1
fb76476dfce3cf74bc499fa38fadaed6d28c2ac6

SHA256
47e5970c74971e0d0e15a3caaba2f9193ba3d7e842b60b0e92f7271e106aed00

SHA512
e5597f1c993db1ccaa340235f583a550e50eea354f674e5b0de5b6b36e818a610a6a9cc8933adbc278d5a514e4720fad81fced7d805a049055ba54368994ccf0

Download Submit