819c6232e6c085165a2e96a0dd2ee3f0cc0594525cd863bb2ce3fd8685ba8ee8

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

93aa17479018644e06c22a93d4441870N.pdf
Size

189KB
MD5

93aa17479018644e06c22a93d4441870
SHA1

8fcf8068edf2c7861c37cd983ba1006b969ba488
SHA256

819c6232e6c085165a2e96a0dd2ee3f0cc0594525cd863bb2ce3fd8685ba8ee8
SHA512

2f9405adb0a9dab43c424296b5dffa7bf87f175e49f14834f937a7a602407813f1c7bd031c79c17e8bcb3521ca931dfbebb22e611d9b1d1de6870ba064495779
SSDEEP

3072:VKvCi56CLq0mahjnvBmH7mBjZmfdQ+oax/bKERd1k+dOxHLbegscvgjSrZ:8aXNKjnvB+mqfdno4DKE31oHLkc4jm

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2852	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2852	AcroRd32.exe
2852	AcroRd32.exe
2852	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\93aa17479018644e06c22a93d4441870N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7d6f2b4072834cea2863b2bc5a85cd00

SHA1
60593442b58ed5c9cf1e6a8c56f6060c140e8413

SHA256
cf3b9312684b32d75d02fb344205c0c3f0178c14bd36d13697049163ef5c30cf

SHA512
56726f86b7207ae9f96540315be939792c94656c3413a27fa85ba2973f0d3068584c54cf6838d76dd9d1f3fbb457fec511c6135a3228413218c5bb4984a75e03

Download Submit