734a76e78b8b48653f8aa9ab08f0b32fd76de3c152034a9cb8f0ed72d316c1c6

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ac55ab79c44470eef5d2b0a06e3430f5c0d7286fcecee3cae2ba6490168d073.pdf
Size

72KB
MD5

aa92da7dcb9e09bf191236c0ae8ba55d
SHA1

ddb85f1763edf97f3913dee38f36eef5d549e5ae
SHA256

6ac55ab79c44470eef5d2b0a06e3430f5c0d7286fcecee3cae2ba6490168d073
SHA512

dd79429e477a9072ffc97fa2e553492496dde7cdd6b502ca0cdc566b6f3c9940dc9a1895fad7cfe00ccdf636b8a05330cf47b2dcd1af9ff0ff25d14d30308912
SSDEEP

1536:ERvExvIlod1ReGNwpFe9MdOT5GaAfcUjJre4WKWJI6s99SHZWApO6YPl:e4Ilod1F39MdcGaMca44WLE99kA6w

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2160	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2160	AcroRd32.exe
2160	AcroRd32.exe
2160	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6ac55ab79c44470eef5d2b0a06e3430f5c0d7286fcecee3cae2ba6490168d073.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ed74f17a815e645733c7212735f3942a

SHA1
5c339908230b4bcb8298c01165b0c9ecd85aac34

SHA256
31a50fe13b1f95b35074eeeca26076142431d700b3f01be603ed56448d136fe6

SHA512
0484722997978524f622537788b6d0b4ff413c2e0e0b1b01dd5932f33a0401f6361cc209403cab6f773f8874c117ea5ed64369d8f3620fec33b93a334d27d747

Download Submit