5f76ff4a158ad4d14b85cb6e2f6dfb0f9e2c63b7c9a35e07f44a81b374500fe0

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f76ff4a158ad4d14b85cb6e2f6dfb0f9e2c63b7c9a35e07f44a81b374500fe0.pdf
Size

143KB
MD5

fece05de16613c9a310d04179a929591
SHA1

88fb7be8ef2fffe0ba3e1ab81f51a362cc54d2fe
SHA256

5f76ff4a158ad4d14b85cb6e2f6dfb0f9e2c63b7c9a35e07f44a81b374500fe0
SHA512

90b4db2dfdda623b8f27ee774fc97cc2d29c80bf12ae70ffe75c5905ce19bc601b4d919f3a0f5289abf1bfd87da48a83f245602956e6d12120c7f77729c54ccd
SSDEEP

3072:SmXxi56CLq0bahjnvBmH7mJjZmfRkQ+o4gaq817xWilX:SEXsKjnvB+mif+noHA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3024	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3024	AcroRd32.exe
3024	AcroRd32.exe
3024	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5f76ff4a158ad4d14b85cb6e2f6dfb0f9e2c63b7c9a35e07f44a81b374500fe0.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
710de505612d2e961212ef62e83b2679

SHA1
d4aa3958b02adee17b7be53217818672407f3191

SHA256
2e56c11977bf77e4f8948bbd5aad94b251d36de8488c42b2fd924caa2f34cc02

SHA512
5f0fbe7b6ecf7d06d09a02a2679bcac7352c2145bc56b95bfdb1be8ff9aff772b46b74e43dc88d2fbdc62490b0703be6a9801c29cfaa7f9f80f858d44137aac4

Download Submit