0a0620da3059b6d9d8d276c7f392c2896d624f35714a26e2fa16e0439fd1f49d

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

473bb6120075a75ed200dcf85ce03fed39fc42b6863e08b6b44b333d78c46cfc.pdf
Size

81KB
MD5

4f2b1439073713cae2d3e2d13e566681
SHA1

7b08eb717f30e1b0fe9b8a8bbaf967418cf04d57
SHA256

473bb6120075a75ed200dcf85ce03fed39fc42b6863e08b6b44b333d78c46cfc
SHA512

3c245502d7d7aae7ccc7df372f6d5c8f21690db11c2214a298c754f49b8bf4ca45cff4e90751855ab79281fb1d455b2d4fb85bff13bf4144d810f929a0d618c7
SSDEEP

1536:8WvsnOIwswL+asrCC4kHOxbAWQDUZUZ1u3PZWOpOaZEWrJhJomZcR7U/UGjNW:ZsnOYY+asuSO2WQDUYg3PSaZPJhJpZSl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1732	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1732	AcroRd32.exe
1732	AcroRd32.exe
1732	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\473bb6120075a75ed200dcf85ce03fed39fc42b6863e08b6b44b333d78c46cfc.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f584e7cdd32a7c50ce5000eee84dc7a5

SHA1
0a4d289dfb429028a7c89372153235de6845e0b6

SHA256
00de3502511c9945267cc0b1858ea4e7d673b2242f1183b6fe7bd9bb61f88180

SHA512
ee22863fe836e49266af11de59da4a64e3818a1ea20e4ca98621b84757595abacf5bc29556b4c1395ce5048ac6bcf7200182bd98b0cc6fc912cd92f9eafecd07

Download Submit