606ce90c4bf8e9072e8dcb78cc8f2d3a3fc080e4cedcfaa5023e2960a7ee400a

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d02a9d62f071f15b3b853896f44d2af0N.pdf
Size

1.7MB
MD5

d02a9d62f071f15b3b853896f44d2af0
SHA1

4cc856d7037b3d03c890abd692ae08d80b090ef5
SHA256

606ce90c4bf8e9072e8dcb78cc8f2d3a3fc080e4cedcfaa5023e2960a7ee400a
SHA512

28b1cbce7166607f185dbcbcc46d24f75d5d6b4434f0c214edf59c07f3e1cb8849b9a5a6d66c7e42b192289ad3f622c856b918825cbd8118351196157cf52877
SSDEEP

49152:8h55KmDvK/p0wVPAmtNkxXMF2uUUeWlXNx506J:655zKB0witXy2wm6J

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2784	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2784	AcroRd32.exe
2784	AcroRd32.exe
2784	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d02a9d62f071f15b3b853896f44d2af0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f932b24c77423486361f02bae5cc40a1

SHA1
f78951cc12bf13143312cc4d3b80a60e69a91d39

SHA256
fdb1bba30f136a0d820dbdfa2f9fa4271e39e111ba586126b2f32b0b282b1372

SHA512
11462766685642c459f741dec71351ca6a3a4ec91f137b5ff6441279a05f7f945a263ccf1555b8dd2cb7a6ced0e0ad4615207f45edd6c8b385119528b9f2d248

Download Submit