8536a9f0c16577019068aeb76f2c8accf03ba44f90d60408628a15847e34de98

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3711b9e721bee06490e126b3784831a0N.pdf
Size

235KB
MD5

3711b9e721bee06490e126b3784831a0
SHA1

c80705bb16157e8bb8b0e2294f88d96fc65a4754
SHA256

8536a9f0c16577019068aeb76f2c8accf03ba44f90d60408628a15847e34de98
SHA512

449d502174ab52d877569cd146abffea013e095cc7f90e6aad4f6e31bcdae1bee9075e23dd0753a18e1db8b1a12d94377644b3f312ad5eec6e685588828db2bd
SSDEEP

6144:isXeKjnvB+mLfunoJZvaQ2CI8V6dsD5VUmOif:isXe6nvBTLfcoJZ/ZasD3XOif

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2104	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2104	AcroRd32.exe
2104	AcroRd32.exe
2104	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3711b9e721bee06490e126b3784831a0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6d4df963b78239496c093bf7b84405fa

SHA1
15e7a2b02858666fe2a52d2d8e2f3d54d761f53c

SHA256
be815e04bb34115da802b3f309d9da2d936c2b593e2d550844f9f7e64954a2ac

SHA512
296cec340bf021f4b545ef2fb0ef80b43885ced51d6e55a00cf92f727ea48e1fd93df209e99930a4c73fb77e3f8551e88453c90c8eb483b8551a90e50f1dd347

Download Submit