514304b5f253e0e60a6f0d3d808bcf9bb91616dc7b833c7c38f57ffceba90964

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc1aa76f00ee9d9af788f0e9adfeab846118cafc6e6f6b7f1a5e7342f89eddd5.pdf
Size

114KB
MD5

4c7633fd18fcf5c1375b67e82015152d
SHA1

b419a243bd4cc6108559ff9319840324f81a2076
SHA256

bc1aa76f00ee9d9af788f0e9adfeab846118cafc6e6f6b7f1a5e7342f89eddd5
SHA512

e6171048b1d19848552ab6ca8194fcd5f2d798a24b679066c05dd02643a633a2e122f4bf94ffd96c157a606a5344e5ef3ac20a2b8d3e2779c8cdb66470a7ac67
SSDEEP

3072:USHobigmnp28raqMSJeS7hofFDFYE0qEHhKd2Z:USIbknXjlJlVAcYEH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3048	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3048	AcroRd32.exe
3048	AcroRd32.exe
3048	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bc1aa76f00ee9d9af788f0e9adfeab846118cafc6e6f6b7f1a5e7342f89eddd5.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4db05f04649455b7e6365b0c235273c8

SHA1
c2090fdde5d11f5b9c71135ab2abfa81f5c2b920

SHA256
60a8210b9d4afb58263f209baaf11bac536091ece3784185fadd5f45825e559f

SHA512
ae9087ae6f9c6253ad6d1c2557bbe3c5ea46f2a64bc295c1e27dfdc57663039e8bba0c56ee230aeb2069001d3a8757679e92153a9c0d1a876e3728feb9fc590e

Download Submit