6c99e2738593b6d24e69ea4434d2f07abd5a7f2eeb1b737c44a643ad68991362

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f2349c2e7458437db50b2664a6d4add2ebc482bbd51f156cc16c51d20b270f4.pdf
Size

34KB
MD5

01d504c4f425393d26c5be9596d23e08
SHA1

20bd8e5ee5f231137bf4957acb74c7cffcf4b440
SHA256

1f2349c2e7458437db50b2664a6d4add2ebc482bbd51f156cc16c51d20b270f4
SHA512

7e167b3471e6b637af5ecafc035c18f05ad5cdea2c90350a794db8eb3611d36ef6b5d9fda884e46a38840e72d81bbc98ce784df796663f9cccea313bbb4334de
SSDEEP

768:RT7ioYJR/6viyBSv3onbb7XRydVLd2PT2v:RvGR/aBEebHXR+Ri2v

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2264	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2264	AcroRd32.exe
2264	AcroRd32.exe
2264	AcroRd32.exe
2264	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1f2349c2e7458437db50b2664a6d4add2ebc482bbd51f156cc16c51d20b270f4.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7ed2c2a7e9f4c4001d6ed6b8ad4275e2

SHA1
ec597c9fe22a8dc915a038b06a14707d0b79ba98

SHA256
6a8d3b66dea886f5cc90af361a888e3497b6a8830ed012906f0b24663cd18e6e

SHA512
980af96fd2c9278d458ca7dbdbb49e502d79454b4f523bc94b2c0fbd03ebe783b665948b3261e0e4e2c433412f5135d4457f799285187bb647cea6b460ee31f2

Download Submit