b1625849666c1934aef40524c46e1be5db9169fe1f2e360874ae47935541397e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 07:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df40437b7ccbbaf704babda4f04ee7a8df1f46669ed036c3bc99a8e390f45bce.pdf
Size

80KB
MD5

ec8d535a3bbc8a2565c0dafea1b4d674
SHA1

777e18e3179b277fa49fc9a47fd66823a5937a23
SHA256

df40437b7ccbbaf704babda4f04ee7a8df1f46669ed036c3bc99a8e390f45bce
SHA512

a7ff6f63b424ff06bca347d2fbf07bb3e42677e7f579761c6a02b24d42f3542890c4bb5284fdf3d7ccfeb759f1cdad3328a14170652e61c07110e0766db243c2
SSDEEP

1536:YZ8sXrDEqNTK7yVPbbKUVhMVV6oZKKoMO3wWspORGWIadBJYy2gg:q8GrDEqR1bbKUVSVdZhO3LRnmMg

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2312	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\df40437b7ccbbaf704babda4f04ee7a8df1f46669ed036c3bc99a8e390f45bce.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e1acd491c51ca831f27969d38bfb767d

SHA1
274041e66d0e296ce2f8a2a006d520e61fecd5f2

SHA256
ad8ce56276ae2c86e0b7141e5cac3bb7689e5f375ac707eab1b6dd094dc25907

SHA512
247b132408d12f894250dfba5d0a37a2652eb28dc0ae0bc0ac0914a10b1dee7b8f749e8315a933094cfe8061e8349a88690fe0a76b50443b99ebcfaa2d098cc7

Download Submit