ac5590a90baad4e363d689adcac2f42ba19ef6cf126e118bf7af3df56e42a5a5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb3e2422b7b4f7e028a41e527975d3c0N.pdf
Size

160KB
MD5

eb3e2422b7b4f7e028a41e527975d3c0
SHA1

a7b10baa0a8f192172c169c99a07f40a1956a0f7
SHA256

ac5590a90baad4e363d689adcac2f42ba19ef6cf126e118bf7af3df56e42a5a5
SHA512

3e270b469079b55ffb0736c8f11986c10d0ae02b2287808abeee7d3c58eb02b2a2f628994a6747ce17a3f9622e5167920c340655608b0f3ab16cb7e8db57bbb2
SSDEEP

3072:dlfcjKi56CLq0wahjnvBmH7mgWjZmf7Q+oFu/0h5tzXC7DlhD2R:zcjKXHKjnvB+mSf7noq0hfXC776

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1976	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1976	AcroRd32.exe
1976	AcroRd32.exe
1976	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eb3e2422b7b4f7e028a41e527975d3c0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3a6b6a6896a6c3631e1a9d3359635e41

SHA1
6861ea62eace13c8b7c3b26647443c209890886f

SHA256
f4b7a1db1df93df7a8f927981eb28de7816c7143b28103fb3f6cfa054ba597a8

SHA512
c453f3e933d6f17029963ef8d0c7061f7fe1010badeb5a8684abb2255e275f9c9e50313f09563fb046780d1b2f923e87d3a0f0fa6646f12f06c4c2335c300322

Download Submit