32dadc4f4863e7f814a0ffb8691df3737972c10bb2c4a800a7adbe113c4ba3d6

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

50ccfdc3d1b166b897d1c615630837c4cc50018eb335452b8921317b234dd5ad.pdf
Size

74KB
MD5

e09eccd505eaffe845a85db562211551
SHA1

b8e27a8c2e96edf939e1cc03fd8ddc9db416b711
SHA256

50ccfdc3d1b166b897d1c615630837c4cc50018eb335452b8921317b234dd5ad
SHA512

432365054e20f19507afbe9df0d7242f53b780c0757007bd61d7eadecbe6775018bf06406bbb7469f236e5d9979a5851ab9db905fcdb0736ce5a8bacff1ac034
SSDEEP

1536:dasLTBdNpv3JLnqpPRRmeIhOZ0eFyW6pOu2cQfWcqLpDFFb:tLTBbp3CPchiFfu2bDSBH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1320	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1320	AcroRd32.exe
1320	AcroRd32.exe
1320	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\50ccfdc3d1b166b897d1c615630837c4cc50018eb335452b8921317b234dd5ad.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
735f3c0441b83b7d081e47341a721cb2

SHA1
418ffb9136201d8401f9cdac097037c51e8dbc8c

SHA256
41fdd81c3556fae2e7f77f3a267d8c9e30e9ffc1d57aae3af5a1e0eb7321412c

SHA512
21b1869201c764909e1057541a9083cbf11439045b991b065419523c2b58f6d91c8201d9af085faea3b4886a0e50297c9c8991d235fa7bf45ccdf52076388224

Download Submit