3c46538a623d84fbdc607eec417bfe7cd0cc7ad02a42f004834dba07e1849cbd

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9aca78059994a8070f5d803a6074a610N.pdf
Size

60KB
MD5

9aca78059994a8070f5d803a6074a610
SHA1

a20bd4be1fb94db42e8097d23ed036108198ba18
SHA256

3c46538a623d84fbdc607eec417bfe7cd0cc7ad02a42f004834dba07e1849cbd
SHA512

07db92781572585143d7894e66b1fe6460067e383a9a62ec4f3171cef4b88c0f3b4d339f5bccf26f592aa4b009e4a9159e986b7e53163bed94909efc2d57768a
SSDEEP

1536:IzIW1dMV+foY5sbYy4m/Dqi6+AVpLNgEcsDgV85N:xWHMkRyPbqrcsDgVaN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2336	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2336	AcroRd32.exe
2336	AcroRd32.exe
2336	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\9aca78059994a8070f5d803a6074a610N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0086a8ea04b0c53b9f5477ffb60c06ca

SHA1
e74dec869851e44619d1a3cdaf6dc4c0c37cfcf7

SHA256
fab9bb3d637085a24a786623d03820c70f8bb08ecfe0ac191ac563a9e79100b7

SHA512
19112f578a5f842aa827b70f5a245cbc52f9b9b1488ca66f221cb550ea5c04badeb87e8b7a6cf8bccb2d4f24ab13833d9cbec5871d28bda02fe981d57195a73e

Download Submit