b73cf4742fc357d9c267be358cc9643a8a19df4b5990a80619c7775e67aeebfc

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b8f6caf2bfac8442cd90789b76eff300N.pdf
Size

145KB
MD5

b8f6caf2bfac8442cd90789b76eff300
SHA1

7ff0f2fd4f56980b8fe0dc7a970110c015a9fbbc
SHA256

b73cf4742fc357d9c267be358cc9643a8a19df4b5990a80619c7775e67aeebfc
SHA512

49a32a2152d7f85bbce17d832fd993ebe162a65026afaf6325dfef8f456e6bc3b91b4b0cba61e5ad41d3c1c7992e3894777e363e595d29e34c234cb9ddf9786e
SSDEEP

3072:hv0i56CLq0wahjnvBmH7mgWjZmf7Q+oeKeUIS0gDF:h8XHKjnvB+mSf7noe/UIQh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2696	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2696	AcroRd32.exe
2696	AcroRd32.exe
2696	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b8f6caf2bfac8442cd90789b76eff300N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
05208d4207e41456695d00b2076ed265

SHA1
7137dbf54fde133e2b1e267481b91eb64d4cc7b9

SHA256
b555be87790561f2f3677c4168c1742b82d78ade6a00cad866fe0b90ac94f76d

SHA512
cfe6c085b4c133b81dad0a850b3a85bfa28ad33e80f23bb8e04c7d9cf94606c1515cf2c8e48500ad3c1d6964084af22cbc2d219bba21304dc443bd202f13ca16

Download Submit