c0c9b30a0d0eb139aecca801cf4bf0e5a62ab69d409e3bc34a84b614e8dd36f4

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ca60ef87f30e9df19670a43edcd5fd0N.pdf
Size

203KB
MD5

7ca60ef87f30e9df19670a43edcd5fd0
SHA1

aad13805d33d210ff2a2d9b55339a2ce1953d064
SHA256

c0c9b30a0d0eb139aecca801cf4bf0e5a62ab69d409e3bc34a84b614e8dd36f4
SHA512

5caabd48bd421114c79de69a8ad671fc844c007ad8db510603c4e2c70bcae61b5b8dd464872f7bc253e921947d918d31d8434863eca13120cb00e33560d89941
SSDEEP

3072:pw8i56CLq0wahjnvBmH7mgWjZmf7Q+opxqdgt5S1oTdS28mt3DERNyNOh7:/XHKjnvB+mSf7nopcdmooTwnG3DGSOh7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
484	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
484	AcroRd32.exe
484	AcroRd32.exe
484	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7ca60ef87f30e9df19670a43edcd5fd0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2129e2f383140bcaba8e1b5a425ee5da

SHA1
96ce5d740eeaf36008140cb71466725bf89a877c

SHA256
0940f6911fd7e7e829909eb825728eea57988a91ea057c7b2af854b79c1cd5d7

SHA512
7ca41ab3ef57bdc0246976a631813bfb7a035742f2db3b57e6a71b1a00c40ebad4e1ce2451faa0177a05ef4fb0c9acd7bc56a1ba4d07e05d2a5c7f99cfbacd29

Download Submit