1d7d10d95a37bc73759fcefc2c64e3ece26a881ba6f28945ea24f657b11e8c86

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc14ef33581127b9befc33e454b402e0N.pdf
Size

164KB
MD5

bc14ef33581127b9befc33e454b402e0
SHA1

8783385dfa2519ad3fc95879640e27a43ee70457
SHA256

1d7d10d95a37bc73759fcefc2c64e3ece26a881ba6f28945ea24f657b11e8c86
SHA512

7c0d57d1791f15ced4e2d7140120421de20f5a8fa896e19c98c3b49ebc64c0be7e72f77848c511ec71474a0e8f0fb894351f4d2774ed07e8fed32b4a8df9bbc2
SSDEEP

3072:Zox0i56CLq0yahjnvBmH7m51jZmfpQ+oJB6GiGQAVX1gZsvK7:fXBKjnvB+mcfpnoJU/GN1gWK7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2780	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2780	AcroRd32.exe
2780	AcroRd32.exe
2780	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bc14ef33581127b9befc33e454b402e0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6d048a5a5988f636ebb5e970ea618920

SHA1
d50c8ac483c05195304fbeda1a8772c9588323a6

SHA256
d9a4672ce007c4707e86abd8b8fe068b088bdb221152efaff90f9c266a49aa1a

SHA512
76f7617d8430ed1fe8bceb7817a57bf4d8041842988177c01883288e45a3f6c22636eaf5ef1a8605a2f8e6691a4b6f1f552c046bf24a85d501645397cf4380e2

Download Submit