1a3ace06f7de8bfd805a7d5f427be6cdc0f2ef49699a8471f9503798197e00c6

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 00:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd07089bc408c525577296f4fd04f4490fd4d494b44dbc8d85d0552d99e524b4.pdf
Size

76KB
MD5

2793b6fc5e509fdfa7e1c4471ec6cd26
SHA1

db8b8a7c033358b39b0782c8307ae83896fea320
SHA256

fd07089bc408c525577296f4fd04f4490fd4d494b44dbc8d85d0552d99e524b4
SHA512

4d7df0ad3c78d39a272bbb857f7c927965989141bda99230609988b0be25702576cb6493a67903216dc5aa774c73957c90a09512220617c08aae81b8622ac345
SSDEEP

1536:K4SoH/1FRZVxuA6H6RCyPu1lkhNuQ83htkPqASNuRDWOpOwrKWJEqdpSTCGO8Q4t:nhfbv+AWgHolkhV8fk7dgwrwMcTCeQw

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1080	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1080	AcroRd32.exe
1080	AcroRd32.exe
1080	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fd07089bc408c525577296f4fd04f4490fd4d494b44dbc8d85d0552d99e524b4.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
aa56258e071bafa459f841dc3bf6ecd2

SHA1
82a4c1b91c1ea64714d1f0b0e907e87984a3cf3b

SHA256
045533d86d4576fda983964b105e794e772ee86e78f2f4bdbeaf40465207c285

SHA512
7e914de929c635937dc23cdce44eee6feec0f5b84e90e9441a248effa3cdaffab576d2f6621bc580901f2ca2b90450230fe11a1e9e3bf25fac6d78207f5847fb

Download Submit