3f53747b07fdb79e4955320e2728d1241111d8723b7f743d62bf95215dd3ed80

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9455786ab12edc1d35ebd11288579770N.pdf
Size

78KB
MD5

9455786ab12edc1d35ebd11288579770
SHA1

202248d51c956ff2c9e0210da207dded1cc44c75
SHA256

3f53747b07fdb79e4955320e2728d1241111d8723b7f743d62bf95215dd3ed80
SHA512

a13af5f5797e12775ba0c63067e8b9d005441f66a0a86adc0afcd5cd79f369e79e94997859f22fdadc0b3a10e241039556f1848880c817f93506b88c9658a552
SSDEEP

1536:pIfqFORrEjzdvXBdd5ZwxK/dmSa8133Tiljeco:8kORQjzNxx1GJ8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1968	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1968	AcroRd32.exe
1968	AcroRd32.exe
1968	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\9455786ab12edc1d35ebd11288579770N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
12ec3ebab0212f63e9a186b89ac0c82f

SHA1
cff92555e6f05376c08c8a6cca334a88e36c346a

SHA256
ed6b8b7a243fde9b617c8225c59540ad402b950dc790cece3c62925dfa0e58cd

SHA512
d8bf4b534b027a477007d86adf4d740ed2a0c576a00d9451db3b55c5cfc840f68c801a328b74fbb7d4f9dda55bf3748d7fdb32b3639f970bba1cbd2b871a177c

Download Submit