29cb608c17b4722c7670dbf8ad2cb8cfb00e6d4db25aee3b9652b39859bbd162

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19d3628eb9a56da86eeaca92ac000abbfbdf008cb6cfc50f50cb2c8c96243402.pdf
Size

74KB
MD5

21514b16bd2192916f5267e53065d451
SHA1

1d941a3da3a251f9298e88efcfce884a4d7fd5f2
SHA256

19d3628eb9a56da86eeaca92ac000abbfbdf008cb6cfc50f50cb2c8c96243402
SHA512

fe3f61253f73c6580b677b28e2bbcf5f9be381fadd180648e56f49ad5373ae5633483cdbeb6d2846fd4b67b391dfcd7078402dbeb24d55f870ae503dd23cbb44
SSDEEP

1536:3V79YZg5AgDHXkeqPEemUUyik1lep8isYWHpOvTWqgEgrKfQRTXi5:F2G5AgLxqPEemhkvep8isAvdFQRE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2572	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2572	AcroRd32.exe
2572	AcroRd32.exe
2572	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\19d3628eb9a56da86eeaca92ac000abbfbdf008cb6cfc50f50cb2c8c96243402.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
27b3aabb3efc59a758e9a2dcd74a9c61

SHA1
215ef87d40f2e79fe1f79271d6f304dbeedfe8a5

SHA256
471790749d8ce5ce0f838b169e2db101d0fc9f047c4f52146cdbc5b2c866b34e

SHA512
f9c9a1d993e5ed8c76f3650999fc300b1854505770716431b8ab0565cae09b2fd6ed49171b3a284194e518920ef1734d1021fcd0080b201be92881b371a3da57

Download Submit