a7adf45cdcf2ac2a3c71c6a575b0fdea09f1f9d6a7622d631e32aca734feccb1

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f95c0578ba81228b10e5286f77d5e60N.pdf
Size

119KB
MD5

2f95c0578ba81228b10e5286f77d5e60
SHA1

2d62f1ce98bb20997c43d405efc451e2498902f5
SHA256

a7adf45cdcf2ac2a3c71c6a575b0fdea09f1f9d6a7622d631e32aca734feccb1
SHA512

14cec905feb28385959b27de9cf2a4e3c17317990d7a63461e4323f73f2ab2144e615801805ba4bc213e000ef5e14bc1c899c6dc888ba20e80a35ba7bba0b2e3
SSDEEP

3072:PkCKQ0d4kDf1s5TonJZZuxLDxKBVrA1kPKte9AscQP:WQ0NfC5sJqNdKBVeY9AS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2232	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2232	AcroRd32.exe
2232	AcroRd32.exe
2232	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2f95c0578ba81228b10e5286f77d5e60N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8eb8e0a4176853a2fc89d6b617a3b34f

SHA1
d19c9672387ad181a803f5203bc0673612adf8ee

SHA256
1d46406d32b397c93df0f4fb8a1f657333468539d3b7ba97ea91085d80f00537

SHA512
181608de8be02b974ec743d6457ebb3420b8123478e002f853d2b4b894c9f9dcf70c6a3d5979ec5d8ff8ba68a9a34fbcd75bf7ceda23e10fd33d1f399aad2fed

Download Submit