173d938fd7699f4027839d2612e0a2228de85e74e9b6a9463cfa6c8b5e8ce8e7

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

87af40c8503a5c1098142250584fbb1c1a88bc7d6ebbbf14e2d9d419a5c7b9d6.pdf
Size

79KB
MD5

5d348eb415e776f9a1ec5faed7c29995
SHA1

fd16d2df7360b0b40d670e330274e1f568b8b6dd
SHA256

87af40c8503a5c1098142250584fbb1c1a88bc7d6ebbbf14e2d9d419a5c7b9d6
SHA512

91216be70aa8d54ad44bf5589368ccce1c9ddba3122db140c03e0cefd75ca2b6c8329155995674be49adfc43604b5990b28e04ef5c3510deb2377fb483c0d16f
SSDEEP

1536:x49FSHwUVe3xe4H/Q0h4ht8VLNzTJNYGRg+twda2xlMFYVbWApO6eWLIikDkN7U5:WWQU03dH/Q0h48VJzTJGCRtwdaalaYU1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2716	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2716	AcroRd32.exe
2716	AcroRd32.exe
2716	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\87af40c8503a5c1098142250584fbb1c1a88bc7d6ebbbf14e2d9d419a5c7b9d6.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d234deb6df9c88aae05ea53d6cc10533

SHA1
861c30b98697cf09abbfaa9f9e92564043e84a85

SHA256
a1687379675a7794936cb9ee3a90e9ebcaffca09a6c92a341537ce9e7c040dac

SHA512
1effcbefc05519b47377b5bf356b042a1d50b6b1e23fe2fa7c62e11e37269a0408518f04a1b8ec64aceea7e3ce8f098ecb51a584bd6019afd69037254d38eb59

Download Submit