5893a81b8800c5e42b1770c74c627bda259cc8a0b73e0d23037f49dec4438d10

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 04:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93fe92d90f4d0a047389049f130706d0N.pdf
Size

469KB
MD5

93fe92d90f4d0a047389049f130706d0
SHA1

939654959c0e8ed0d9a84e7ae0b6c71d7407aaba
SHA256

5893a81b8800c5e42b1770c74c627bda259cc8a0b73e0d23037f49dec4438d10
SHA512

10108918abb1e622cb0792cffc5e619641e2d09edf332bf99e915562a99c3f3a867f96b8d09af596a4881e29de53ac83efa7ac559016d81d8679023580f344a1
SSDEEP

12288:5h43XH6nvBTSfroxqz8i1lh0Roq8G3ZjkcENtuqUKEEcunynS:H43Xan5TkoxliN0Rf5ItX1f9+S

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1420	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1420	AcroRd32.exe
1420	AcroRd32.exe
1420	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\93fe92d90f4d0a047389049f130706d0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
25a98ca7d1833637a1cc698dd01dc2a8

SHA1
700d22e726e00fe24191b9db41d758c617ecd864

SHA256
31c8f48565e819f6779ca00416b7275e76c30f6d6eba4015caf89498556fcf10

SHA512
d13ec93fb190deee15ef725bae081650863255b2a8cce398b54fe23b64957f7e768265a20353a795c8fbb0995127515ed2b4e36cec4b382c0bd7e45e1378e2b7

Download Submit