72520a90d5afaef33292e812c6dc7b898fd96f1aa1229110ffb19f47a272c208

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15010e4495cb736733676121d96e39a3639158b663815e5f756cce4a7fa8d58d.pdf
Size

46KB
MD5

2303b0cfd3d33bc9fc0cd986fcd1890f
SHA1

0ff630e6d0ad76e3c6fc1896b10ff60126ab468b
SHA256

15010e4495cb736733676121d96e39a3639158b663815e5f756cce4a7fa8d58d
SHA512

14a58cc8c0d4a6f1a778690ca05fef8fa0c8d4d7c54d053010437e3484bd488420272683e45603ec096e9ef28c6ca5fc701a1295fa4460c85115b80d1f2be9a8
SSDEEP

768:esq5ykpqKpiG9Aon7U6XGfGPpnX+VdsDFe7Z19MBBlFlhY4m7q2:esSy2oG2ofXG6pnodMw1190A40J

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2544	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2544	AcroRd32.exe
2544	AcroRd32.exe
2544	AcroRd32.exe
2544	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\15010e4495cb736733676121d96e39a3639158b663815e5f756cce4a7fa8d58d.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3e96edde97dd0ee5c6f7ad62aaa6b5a0

SHA1
37a158e9671e76b5b792c272acd299cea07eb2e9

SHA256
978cd7dc172102ffeabe8bf42dbd971f41b30dd975e9271b733d65972d1057a8

SHA512
e0f2865eb89f82bea64171f9ec16b815ce3021ed65765a0adf8541149e5d4323043a7deb377f04550bc61cd5bc76713b9b6201bf75a786bd7784cc5f1ba79c46

Download Submit