747023bc08702482e0f30704fce3305c6be58dea093833f8b79d766085dceddf

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d6b743c47b50e1128b971ca7cb725cf172a1053eeb7762dd34a7c500b16f0ca.pdf
Size

98KB
MD5

97db2c27ddf09e5d8120884188a6aaad
SHA1

784f789592dc8dacc78ad833c544abb41c0e1883
SHA256

5d6b743c47b50e1128b971ca7cb725cf172a1053eeb7762dd34a7c500b16f0ca
SHA512

28f855ef906cd59209ec975faad0a309e534eb3fe718c07a92252b99c218481424f84c1ea6fb70e1b13d0aaf35ec7a5189e1c21e49d80841eed64c6b0d74dc6e
SSDEEP

1536:ENxuW5jeQBv0Y22Sxdik46PAyfCHlm7YY2Jh3aqn159SITdrqKvbVZC/OC:/WFeOMY2dckRoyyaYnau159S4kKTeZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2584	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5d6b743c47b50e1128b971ca7cb725cf172a1053eeb7762dd34a7c500b16f0ca.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5ba8028f848ff079e8972760fc5e6550

SHA1
20c83be9395f6984b30b5d39efb4aab1d86163d3

SHA256
d0d5ea92c19f7a1c38c15b517bb0b1587d6f783a9e86d620e473c282f0b1f289

SHA512
0a00025f78bafde4411f2a34715c02bad8ff7952f65bb939ae6d704b2ea65a8a020ad657983afa0f4326b3f405269078e5da119886e5ec55d710cc8f25cb4a3f

Download Submit