4c0c97f5a0d0817086e9163232230abcacf2c89ecca94fe6c3f4439229f4f3b3

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8a28f7eff3e19771cfaf64d7d2b4e40N.pdf
Size

145KB
MD5

a8a28f7eff3e19771cfaf64d7d2b4e40
SHA1

027e8fc57c71e1f4fd66cba6db86001f6c18e177
SHA256

4c0c97f5a0d0817086e9163232230abcacf2c89ecca94fe6c3f4439229f4f3b3
SHA512

9fe9d944d19d4405214deeb033a6b1967686448f484d92022e7a72acaa30331e53b1086d76ce3233a6833c4e7a4fc343fefc8815ee898e4d6f0db05ef757bf6f
SSDEEP

3072:HW4i56CLq0OtahjnvBmH7mtjZmfbQ+o8eTdE/GbKvI:VXzKjnvB+mefbnoNdbbB

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2028	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2028	AcroRd32.exe
2028	AcroRd32.exe
2028	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a8a28f7eff3e19771cfaf64d7d2b4e40N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
02518eacd6e34c6e97719e4e67242a91

SHA1
34aa7838bc28759f32e32da5a2b81e41a0e1e8b0

SHA256
0963bbff70dab457de6fc4fa8a6148a966a264b672de2a6e6e48d3a0a3601cd8

SHA512
877de1a35f220d95d71c17e5462d1b7145317225552d5eb00ef267156a7678fb03ce90f072c7904701a73c4204eda7854dfa30d1d07bd03621b763dfa97a070b

Download Submit