ebe6bed65e5e35e977a8ef14e1b65be982f516e697db7a291ffd8e1bcb9e1cae

Analysis

max time kernel
95s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4beb920c0d0315918a35db1c4c5b9770N.pdf
Size

57KB
MD5

4beb920c0d0315918a35db1c4c5b9770
SHA1

263b6e159f8afeb2a713048b9dab3f82d3f74a89
SHA256

ebe6bed65e5e35e977a8ef14e1b65be982f516e697db7a291ffd8e1bcb9e1cae
SHA512

4a51655f6e531d53bc14bc7521b5801f4a69c1bec768b117f47ede8cf7f001689c139f96a2513d6fe31a37bce97178dc1ebbfc956f093fcda2b31d388d1b9dc8
SSDEEP

1536:kEid78v5Rom2U0uFrhuDZeun3f3udDjiJ3agUw3+71Gr:a8hp6cun3/yD8I7e

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1140	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1140	AcroRd32.exe
1140	AcroRd32.exe
1140	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4beb920c0d0315918a35db1c4c5b9770N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ac10a0317689cbb0ddfe27bf59c37c3c

SHA1
b30a02995e8140ec7eecd60aeb5e48baf9ac7f51

SHA256
2e965d4e676fbd5f9d073501f67dbf5287c3ee806145179707b03ad33a92256d

SHA512
436978b070b83428800b2632b22d59f3e9e7135eeec4ee6b2f7d2d5dfdbaabbbb29f0545aefc500ea2080e66b2d403d62f390ffd82d6d3e7f99f5e29d5589da0

Download Submit