ee822b5229f0098318c2f8deca9405d6ad6e99b5815161518cb48febbc0a3c53

Analysis

max time kernel
94s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c04e4b6f0022c5671fa3a54c5cce270N.pdf
Size

245KB
MD5

8c04e4b6f0022c5671fa3a54c5cce270
SHA1

4ca06341ea5ca78ccee988209104f23eda0dd80c
SHA256

ee822b5229f0098318c2f8deca9405d6ad6e99b5815161518cb48febbc0a3c53
SHA512

0f5ec9bab24dcea6f8bdc4b32016b88031c69b5d637808f9e03f008bd11693005ab80923b5163bd985fc8d64c16fe7ffda7a450d3b72a78f5a3e586e096069ec
SSDEEP

6144:+F13h3jzrzg3dhzSqJb0EEKcsiXVr17UYBDNoL:OBqH/d7SrZxNoL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2564	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8c04e4b6f0022c5671fa3a54c5cce270N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7e6c06a5505319fcdaec76d8c0ec788a

SHA1
a1d8852e4ec0303facb900bd759d18ecbcdd3462

SHA256
f60a8ee8201e90c6dfaf7e00d04cb3955cdeae75e42f8f669e2193add25fe535

SHA512
055d8da5ba101b4eb92b489bab91147ce8bc56194601093f4d1346e3a72961acca14e722b51b304740257385e4a35b80cf7ce54564512b7a29006112fdc43be9

Download Submit