6fb73bd1111d8b06addf274b37a095a7f876c4d0bd06da11fc4cd162f184a6a9

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 12:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

211f940ee6c3e1aff63f37e7ffd099e832b87874757bb1573d7076e677f3d3aa.pdf
Size

87KB
MD5

0ff222e90a6c95490c7e3bd0b0b2bebc
SHA1

ccbda1c20330a9b0a696fe23c499736ad78d31b6
SHA256

211f940ee6c3e1aff63f37e7ffd099e832b87874757bb1573d7076e677f3d3aa
SHA512

9f7038ca1feba8305b7ca83212510fdc3933b00f4b54a5ea9bdaf94a778e5a8892604e0d78e535e20abeb86a9e2fc2b8b37cd113c26ee1a55fa9be40df96f1ba
SSDEEP

1536:ae/xbZdVmmDHxNG6TXqT2B7rCqVFKQSUsskLN7UwLdrxY6bWQpOCoWyNBOelhJG+:L/xbRH7DX7Wqv6UK1w6GCizNj27IN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3048	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3048	AcroRd32.exe
3048	AcroRd32.exe
3048	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\211f940ee6c3e1aff63f37e7ffd099e832b87874757bb1573d7076e677f3d3aa.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
beb943a6f736086bf1b833d319e30453

SHA1
bbc568459fa0c91a986fe819c26054c1792d0928

SHA256
6a7e761d1ff400ec53fa1408eb10611e502a6dfb1b8822d4ec0473cc962001aa

SHA512
5fd29135d2352544c3e8ed1792db5f73283a62ca55fd872a60ce654d8f35293697bed55628717a676a004c41eec0bb62c7bd88d3cd44943c08f06e0c3b873a90

Download Submit