e98daa67bf9fd9faaa4333d50f820851d19a1a6b032e5eabf5a7960301cc17ab

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de63212b485d12dd5f25c46460123456a6f6cf2ae486a14b7d1def7a6253fbb7.pdf
Size

77KB
MD5

9c6b8e9f2642d16d38afc00e15269255
SHA1

2007d5020dd77bba4063dafc74cea83751e73daf
SHA256

de63212b485d12dd5f25c46460123456a6f6cf2ae486a14b7d1def7a6253fbb7
SHA512

e3c2347462566993e2852e30f9edd49272d0017d7225db9f788972d0779cc7c16db922bfd7b9f3354d9b9c337ce99adf50bfa1bee9bff2adc73766fa90c2a826
SSDEEP

1536:rtcydzQfaaBVXHhUVlEkhsFfRkPu61Wp/Q8HNAmm4WepOix4nK8R6:BGfZRhUV+qsFOPPY/QjmmFiGKd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
588	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
588	AcroRd32.exe
588	AcroRd32.exe
588	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\de63212b485d12dd5f25c46460123456a6f6cf2ae486a14b7d1def7a6253fbb7.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0f3b320982690037450aec0923192881

SHA1
0203a3e5d54ae6128f58594e753f09d1a7dc5eb7

SHA256
dbda1513aaaf63decd4d7c524ed212c230d8eeaf5c1f60b705aacfdede862cb3

SHA512
f315c6b764620efd5d852393e8382cf403a37a50fada7add9362f356f1645cd659cbf90428a085361dd12ea43309fe93d2694495799596cbe10c3ade4f532da9

Download Submit