248c620979a2e6debd2fadd3ed8b03600fca9060f47aad0e89eb1de289910253

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c0b1545337ec0d9fe443af854cd4f30N.pdf
Size

48KB
MD5

7c0b1545337ec0d9fe443af854cd4f30
SHA1

5564ad40c4eaceec961c1cf4134a4526e41b8814
SHA256

248c620979a2e6debd2fadd3ed8b03600fca9060f47aad0e89eb1de289910253
SHA512

b97d6958e15d23789d6b45d34cb2e5bf44d132e7d735a632d2bf324d08f44b727e3d99f89285a388539387b04e416c355252437fa7dfba4c3a794257bd8f9ace
SSDEEP

768:aNcj51i/4AxVjz2nQfirb8sHSsWKjm5mYoUcEFUKMU+skLLXv2RTIMj:Bj5A/4AxVv8rbrdW8mYYo3uJMU+rLRA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2272	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7c0b1545337ec0d9fe443af854cd4f30N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ad20da109359dd0a99f808ebe5a28d42

SHA1
5864d928d18686bfbe7accf96dbaa68a945f0483

SHA256
1d364187df17a60257e6c180d318a51c51a09d3dcbed6ac4462448fbdb8bf389

SHA512
0a2eaef0b34a7db64fadf127843a7759858865e5ce2709aea52af16e226978c851b84a99e0b9de2ea4781830f03729313fa1998a6d70f1bf7d4c21830d44cb84

Download Submit