b88c9da722463647d37735678f5c528c3adf74f9db94dc5dc85c0df8d3e8718c

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02-09-2024 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db2245780e9872ddf05ca41554d94150N.pdf
Size

308KB
MD5

db2245780e9872ddf05ca41554d94150
SHA1

0bc9a12c4ea966c593996b605554417842fa03bc
SHA256

b88c9da722463647d37735678f5c528c3adf74f9db94dc5dc85c0df8d3e8718c
SHA512

07983a1e0ec39d0980a36fe7579c677f8fe04f1197222baa0dbf26046920e121ce08e3dc39836c04374e9884e558d6b5467d689f598bd258a61ea2caca3f544f
SSDEEP

3072:b7X4BR/Vb3M3TNwh5DCemo2eOGTqp4PzRTY1TiU3o3DNIg3N+JuWrJ:n4vR3M35iJdhG+bRiOUEt3N+JDl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2232	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2232	AcroRd32.exe
2232	AcroRd32.exe
2232	AcroRd32.exe
2232	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\db2245780e9872ddf05ca41554d94150N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8a7e72d81dcf7725cd06bbb12c229677

SHA1
4859c2a6f2413e993996df7e4757c6d4785b1df6

SHA256
ba49ff545e3872653fad81dba74329bccc62bcb1d8b278758c5bb55ec578a4d0

SHA512
5d8ad9171069d91d797ba741064fccbd56f9c683e9b7499d90348f8db477fa19379382d2bde91132e83410e8d4950528652c8c482ba512b8a1dd708191e14318

Download Submit