2a84cb67761ff6c5799f2cd596fe03b920260a05709b5ed9c3d5d2680d91db8a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17d036f3009623675e962d5147518a6d78f31d52e84e07cceb38a0f7176cfdaf.pdf
Size

72KB
MD5

a42b9cb2c37a8cf2b898519d6166e0b9
SHA1

6ecb99673e67853bc3afc0670ef719b3976fbf25
SHA256

17d036f3009623675e962d5147518a6d78f31d52e84e07cceb38a0f7176cfdaf
SHA512

ef8a181eebd9732705f79e01638c9d9b432057723520bb50e542b4c27909b4c8b7b0ecec17d8fe5fad1537f322d0652cfbdcbfa0340890da7be937c4bbd62dfe
SSDEEP

1536:f0SNCCHuM0jJaM9LvsLnrOoCC+ZWbpONLI9V9jvHWxEmJ9S6Rt:cKeHjwMBvsLrOfbNLI9fbyJ93

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1852	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1852	AcroRd32.exe
1852	AcroRd32.exe
1852	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\17d036f3009623675e962d5147518a6d78f31d52e84e07cceb38a0f7176cfdaf.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0c05ca1c8e5b81f9267949f9527f9710

SHA1
8f1301be0f00dda03628bfbf47a8bb6197716c46

SHA256
611c7e597aaae07ea499fd12da2c3ad9b547ad48238736536292a7a3da3a6fc7

SHA512
b4193475c5b74457c0f72fa365904ecf83fb02bda4b95ee36fc30218a2fca237a3468979cc352b0f29ff460576074d10a2ec77f002c51e85d4b0a0be9d76a88c

Download Submit