cc624c008deae0922e4da1c4cf3ccdd43a25ba39ea9934b007d4ada944c6ecec

Analysis

max time kernel
94s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 08:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d02c95267b9172d4948dc5b7337ebf0N.pdf
Size

156KB
MD5

2d02c95267b9172d4948dc5b7337ebf0
SHA1

42be78c5697334231516989f3c79436853ee9ec6
SHA256

cc624c008deae0922e4da1c4cf3ccdd43a25ba39ea9934b007d4ada944c6ecec
SHA512

df90b6342467fbd6fa2e9430c98147e5d6b2c327890108aba1e3e094365b9a924ce44773f6dd450f44b3126be3b3b2b70cebc68364d5f8788b78463b54063516
SSDEEP

3072:H9FWki56CLq0PahjnvBmH7mvUjZmfkQ+oPO+/WA1EsZLY1wuU:dFfXIKjnvB+mFfknoZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2264	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2264	AcroRd32.exe
2264	AcroRd32.exe
2264	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2d02c95267b9172d4948dc5b7337ebf0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8f56dcbc6977f39c38e71242fe226cdc

SHA1
525d59aaf250e07f9dcebb445263a36e07eeb001

SHA256
e32f40d9e4168aad756efc4624767d6f83ac0574d8b006cf839a33d795f9babc

SHA512
f242dbfdcef7da19a9c679a74e9aea2b4d0f1550fdfdf90dbbe6bacb392220683af1e4962d8c10a43a6064d6d3dc666dff515963901ad327f093292e5924a25c

Download Submit