c83a311836667f684eacaf14d3b79f13ae5cbb1b2ee2c3400ea806bfb96d1dc0

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

493a4d6d84dd234093eb7efcb4db403c61f0832b23d587369f276e0d34d224c1.pdf
Size

34KB
MD5

78d039d38307850d8fa79eb9fc1cca44
SHA1

300c5a3a702411c3b4ea14a5070f16d0dae99417
SHA256

493a4d6d84dd234093eb7efcb4db403c61f0832b23d587369f276e0d34d224c1
SHA512

7992fb40c98e054e1a99b055104aba7d315ec923a57b23d13669bb6979f904383843a80c599679b3dcf4659408026398e1a5b63cc30c81d57c6bf0980db15999
SSDEEP

768:B5IF27Sdmcstjs8Yv3fr7brhArOGvQEX+O2vTl:BNmdqzYvz7b1ApvQO+nTl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2012	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2012	AcroRd32.exe
2012	AcroRd32.exe
2012	AcroRd32.exe
2012	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\493a4d6d84dd234093eb7efcb4db403c61f0832b23d587369f276e0d34d224c1.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a0e97f69385b6e0451438abd0e57b8dc

SHA1
4a3afa565123ba9c6c99c2bd05266e8aae8f7f87

SHA256
78711a173bc070ceedaa8f35f272c8bb78af9d0f3b274a9a95b7aa3114dae046

SHA512
88435e670453e0082e549957a754eefd49119194f24e575e5f93f496b1d6817c80485f76cb2653bef50f9674fd2ff352e5fb6864886eacfba58e4984ac1d0c53

Download Submit