afdade028c658ec2fc493e5bba0b3c348bead41bb5fe94aa0fb5123ef087bc3b

Analysis

max time kernel
94s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 04:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e323d69e6b8acea696d86eedf9d648a0N.pdf
Size

162KB
MD5

e323d69e6b8acea696d86eedf9d648a0
SHA1

a0a9b4756302fe3ae7562af7a1d6ec7913ff1588
SHA256

afdade028c658ec2fc493e5bba0b3c348bead41bb5fe94aa0fb5123ef087bc3b
SHA512

5c9cd94b7d9f22e574a4f52143ec7960daba195975c04e17ea313a279a1fb3b5965a2450ffe1393a132d3422ddbd1d9786d746d053d293de39cc000e5163d6d8
SSDEEP

3072:PgA23j7psMOBWdPng0npI7b9ME/1b79eDhA:QpOB8/g+pgbP/1bz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2312	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e323d69e6b8acea696d86eedf9d648a0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e4558638bf440a690ed2e5e30be2290a

SHA1
7e75ad7c67a7cd2aec98f82039ef6ba29edde442

SHA256
336268922e2ccc77fa0307160d6e249c864f1d59953a59ebd8c8045aae487ba6

SHA512
8b373f9329d4984cc87986481253d02a668dfaaa519c82f59f098f295a5f2ff06d5f2f6bffc2463802966cd4f320e89a14523d2339980ebdbae50cd9894ec99f

Download Submit