63d27ec8ce58947a73a867b067a4799f6ab5e2b3f6826a0b452a0c879a10fda6

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44972e897dcb53c5801c7256e456f29bffb6aefa8c0d1b7d8ccc0cb48b1c3638.pdf
Size

80KB
MD5

036fd457192274f6bafbba90c03021ed
SHA1

ecc40c4074c8cde0b7462086f6d658f3401792de
SHA256

44972e897dcb53c5801c7256e456f29bffb6aefa8c0d1b7d8ccc0cb48b1c3638
SHA512

8914af499ad381c90e836de6b20646a57a0b4e604cca0efd67e08b270452981b9f29f6c09bf0f5627e5dfdda63d9436d741e78d5b8427de906b9b2c7826fc588
SSDEEP

1536:etR/wm8lq6fniD05BUy02KSr/zkMZuhnsdmpWD/MgSljZRZvWUpO7YJ0:M/WfjjZPr/Yhn4mG/MjlFRZC7f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2460	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2460	AcroRd32.exe
2460	AcroRd32.exe
2460	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\44972e897dcb53c5801c7256e456f29bffb6aefa8c0d1b7d8ccc0cb48b1c3638.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b1b4ff0270999d2e94047c21f99d6a82

SHA1
8b77a0ee48fcfe8da33f384561278710a9e9ee70

SHA256
73afa0023e855f6d6613d751441b653fa73503e9ebf05ac07bf5cb047ef127b3

SHA512
ad3e23ccb7991f9a9ea3a05e6e1157ceb31cf6d5768021db8a8e2663bf71f3557e0441c9d3020a2a29e4e7af647bbf775e69bc34a8b7b631169ebce5014ffd12

Download Submit