89188506380863ec8fd4d46085b59c94b9af544ae0f4bef5aad0dc787eb9ede1

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c5021a90caabd13ae4dc5d8115c9870N.pdf
Size

72KB
MD5

5c5021a90caabd13ae4dc5d8115c9870
SHA1

d24b34913c3ea3a4905674f9ab51e71ee3a8c4f6
SHA256

89188506380863ec8fd4d46085b59c94b9af544ae0f4bef5aad0dc787eb9ede1
SHA512

899048e48a4b2ba10a54657d88c72b406f2b5c8660a2101b2904ed9b104a583e04504ec4b17dce2c858c5f556d3b33dc7268825c344dc609522d957a2af7703c
SSDEEP

1536:RdqGVLo8t4ROtfLm9TnOXCgDF2222W93KAHQL:RdqGVktAtyOyus93KAHi

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2752	AcroRd32.exe
2752	AcroRd32.exe
2752	AcroRd32.exe
2752	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5c5021a90caabd13ae4dc5d8115c9870N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c70adb40e4d38cd2ccbf6b4db6c9122a

SHA1
cc8e14dae96943c74d0fb47fb1aa62bb889bcd93

SHA256
1982358298c69dad3a54c6e1a40701c6a8c458cd36971e963f5ecc3810a93be6

SHA512
7a8cbda0738f1a3f895e74ed4a92f8feed84519e6e6e47e55e81b5a4e28699ce4d2c41201c44d0e99a56fb050074b1516f006bb6ef68b032d08d1a872c61b071

Download Submit