1ad69009ade676978d00def318c0f97e5b08fab8b0395f8f04af1c62fdff47b2

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4157f34bb3401d9eda0c9ffed70d2d2a93306997956e773655226934d881e242.pdf
Size

82KB
MD5

653f0004a3acb201018390f5e30c3764
SHA1

0e55a8b7421975a76c7841adfe0d7bf464e52d8a
SHA256

4157f34bb3401d9eda0c9ffed70d2d2a93306997956e773655226934d881e242
SHA512

4af4307f5d03dd5522dc2edf7d27681987ba2717f37b7514d3771b9e01a39292ac7daa8445cfeb9b8e21207c70e72e7e1fb03a775113a1acd9c18a125d3fac69
SSDEEP

1536:+4MEcYvUDK0efNFIOq39ZRwzjBui/Ixvgs7uO6WGpOK5WoQQFWInNDhgRd:HxJvsd+NF5qNzEBuiCv/7uOjKKQdhE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2552	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2552	AcroRd32.exe
2552	AcroRd32.exe
2552	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4157f34bb3401d9eda0c9ffed70d2d2a93306997956e773655226934d881e242.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
053628a98d3c72166cb207ae37508912

SHA1
3368882408097e1bd119a70ea7d39e08d612548d

SHA256
2c93f848b8648b2ec50921d68da94b7346627678055db802eec30d49e1492413

SHA512
25f179b1535b216897cbd9629beba9a7e51f0f3e3d67d3dd172c545f524223e915464ab90e9b6c9f445bafb97c3157dc4bbca25841f1bd98884f86e350076aa2

Download Submit