500112ad0302ba83dd44da7de2b09ce39fb2c86b8b24fa9fc8b7868c105be27d

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5926385a4553c906dee674307b721ef6491f8f791adce036578a5c43aab28842.pdf
Size

90KB
MD5

758727def796c62eec08d0bd97c87623
SHA1

c162777ed7fcec8dfdf349fd5c4071bcb04e51fc
SHA256

5926385a4553c906dee674307b721ef6491f8f791adce036578a5c43aab28842
SHA512

d50df1a6b68653fd1af3a5bd8d01bd1348770b83493dd1a6f99ef014b105645633e27f0be02d24371a263836032957dc7a1bf63ce63c7334b971a342faa0fe46
SSDEEP

1536:q5REzOJBY1RqAd7QBjQh2qE0C7tRdoQTIzWF5F6kZWXE/5FBW2QtWGpOGMgkVjKJ:IzJBYdOjQQ+C7tRdo+F6AfQiGMg2ZO

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2984	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2984	AcroRd32.exe
2984	AcroRd32.exe
2984	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5926385a4553c906dee674307b721ef6491f8f791adce036578a5c43aab28842.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c799e3b4f8c49a706f9167f144c8a8e4

SHA1
a758a30816744173404b232339432e3c7b8b6202

SHA256
62808e2d17be98d73e09f498a10b598211e74ed089d44371a657b66b13646b0c

SHA512
a7540255e9faf1cb012a3f06236c8467e6978d77db9700d4c794fa7cef4b808869c1da2ceaf0969933291dd000161d65cfd5ac305f81769bde842ad1fad3c555

Download Submit