81a2f676da022646fcf32ef4e1412b7b11b811b291acca81ad849e8e2b54d6d4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20fe8e094e43b26115ec77c2e1d340e0998b7c8a37196988d4816970138540ea.pdf
Size

82KB
MD5

40bbb01b6b184133bcb3e557b8fb5e0f
SHA1

266246b626dd7bf8871bf2ea5b952b352b6c6359
SHA256

20fe8e094e43b26115ec77c2e1d340e0998b7c8a37196988d4816970138540ea
SHA512

0a914a2d763b0780023a06234ddb8e4dbdc6385d83f3f28ede2e4a52a8d0b8c422c6bc43583a0757ea013bbf11476f65eb85f677779894f5732295d172202107
SSDEEP

1536:URF5OkZc5et1ywsrkDBkV4JlUhWSSsvZkLWUpO75z+hcDmA:KRZc54yZwDBkVqUxvZke7Zkc1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2584	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2584	AcroRd32.exe
2584	AcroRd32.exe
2584	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\20fe8e094e43b26115ec77c2e1d340e0998b7c8a37196988d4816970138540ea.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
34d01f63a21c33927865937a8512dc9a

SHA1
7ebf7ba6e4a2fe41e57a7240713107c5f7c61f5d

SHA256
c846a2b3366c47642fed4a571bc885ec2d0676befe4ed06eef2dfd1cb1635e72

SHA512
fd4c65ed2b7cae0ca8a6ffb2bba3768e86cbb3c8060b89bf1edf2d1ffbed05ea5272018f2d1537fc2f0411bb9bcdddccf662447221daf52f0d42ff9a15b79376

Download Submit