b80866bf84425b4d73dbe40d670e4b1b151dce8297634fe3a85e5af1e8fb8082

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c959ec2db96c84535a47ce9eb36bc30N.pdf
Size

137KB
MD5

9c959ec2db96c84535a47ce9eb36bc30
SHA1

5e5a704d1702c0138303b5715c9d0d2e93e14b4a
SHA256

b80866bf84425b4d73dbe40d670e4b1b151dce8297634fe3a85e5af1e8fb8082
SHA512

4bdc8c455fca42edb2f23f4ed068f81430283b535076248f8e18b40a0283a1b95021e21512dd24719b330d23119ab50446d87041c553c759f73dd41c693776f9
SSDEEP

3072:+c8hSXi56CLq0mahjnvBmH7mBjZmfdQ+oothCe3FjV:+B0XNKjnvB+mqfdnootF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2312	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\9c959ec2db96c84535a47ce9eb36bc30N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ff603d8c6449c059e79c4591894fbed5

SHA1
4f9982a3a1db82ee1369ef2518de12b4ec7a4655

SHA256
bc9a6b4014e3aa0f4ef0a54805ef4749a178f4052ec9502f46be46a0df0e8c55

SHA512
4c8e6d75ed16e3979c9b0bab6d1b2cdb60d2bad1bc73bddf035e145c775f994ab57d17c5324265a031aa76ae038a6ec243f46f0a2d71e783c7325ee120a2b48b

Download Submit