47b3d6f6c835fb888a2ecfae114a46143a80415392b129f6e78257685bf146ee

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b510c3c663e0e892a29e8760c9f709b0N.pdf
Size

157KB
MD5

b510c3c663e0e892a29e8760c9f709b0
SHA1

206826eede72a04470c5c0feaa3a25fe95411d29
SHA256

47b3d6f6c835fb888a2ecfae114a46143a80415392b129f6e78257685bf146ee
SHA512

36f5ea9ff9c6e2c0e509e726cc5611f547bab3369f9c743dbbbbb22625ee3a5c68c306b60c8e9e63f87945540e12b23455f4eac38ce27c4b624bd5d08bd2e547
SSDEEP

3072:wd3ti56CLq0dahjnvBmH7mGjZmfkQ+oHphwg75:+3tXWKjnvB+mbfknoHXwgN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1908	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1908	AcroRd32.exe
1908	AcroRd32.exe
1908	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b510c3c663e0e892a29e8760c9f709b0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bc9ed96a1ae8bc0d42d6787c82a99b63

SHA1
f41918055dba108e3daa82f8846e353c453cf363

SHA256
e9176c988b8304072decac15747bf903d4da9a3971b0d2bd6681ebe75a178108

SHA512
c5e4ab7609010476a073d9bf8afd429a591fe2e02030f28a9d5f6a515fde960b9d97da9721f915fb520659e0dfadd0b65fca70313a723fb76f96f9d28ba8eda0

Download Submit