23382ecbd6d9f06328055b90ba099087a25f17e1c9660a36bef097cb09752d57

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59039aa58983911c43492bbe37d0f8eee999ab3c94403e759fb9c1fec92bde24.pdf
Size

78KB
MD5

ebe2167776102307baeef557c2010bc0
SHA1

ee57b94834a304183069ecbf64305c9b7d2b5a4f
SHA256

59039aa58983911c43492bbe37d0f8eee999ab3c94403e759fb9c1fec92bde24
SHA512

8fc163f753bd897f34955d749311d84b2105d830aad1d082bfa0bc072b89669fbebf3fcf20f4fc464f9d8ecca77dcc6e5fb231d307003b95361cd0faa69246df
SSDEEP

1536:6vC6RmeQfMv8GwmpDF19Y0TTczJ8J7oJ23MDA0caE8WFY4rzhnaY8PCd:WEHfE8GwmpDFgyTczOtfc19WFfrzJaYb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2908	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2908	AcroRd32.exe
2908	AcroRd32.exe
2908	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\59039aa58983911c43492bbe37d0f8eee999ab3c94403e759fb9c1fec92bde24.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a6521b211d58e2ad022f08f718a1c511

SHA1
391af6a4c0fcf78dfb8ebc865568f4919bb9f082

SHA256
480ef187b764c8f71e8f97e46deb27af5df6c6fccd814d7479447842ca84a107

SHA512
5dcafca46d8e939deb8046de4f9a409c721dde7ec831e85b7030c3bb7bf85ecbf110be15f67cae95603f634c91403fd9760babd99aac58fc9ff4d2bc3cce1f1a

Download Submit