14d312b535a7d2809e31f72d51418da5f09b8afc7808dfca577663319da2c6c3

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 13:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

83d1ff2be215320a3ddd5c5a9d47291552dca8a38623111ac64c26ab68f8ffa7.pdf
Size

68KB
MD5

4953ad3e8e96ee3a18a425d2afe70817
SHA1

e3b568fbc983490aab843803fc3338636f141f98
SHA256

83d1ff2be215320a3ddd5c5a9d47291552dca8a38623111ac64c26ab68f8ffa7
SHA512

dd602848f85e6bc856f3d0cecb2964cceeafafba039f3b3d49f4e897df5f50478e341184e215e2f2d9c64622e614f3e7e28e47ca304422d8792ee6ad4bbf15e8
SSDEEP

1536:D1uLsTSB7kmY68z4NNm67zoUA/Tt+0btlp8FMr2ET0AkfTAiFLGrUG3xQL:wkk82NW+A3p82KERqTfxGrF3G

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2652	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2652	AcroRd32.exe
2652	AcroRd32.exe
2652	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\83d1ff2be215320a3ddd5c5a9d47291552dca8a38623111ac64c26ab68f8ffa7.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
43f5d9ec57a9e51d43f2220882b94b89

SHA1
190c8c8c9f9ea36284794925f2edb495bb859af1

SHA256
70f2dd1fd2e9d87a5b9633700e68e6786d240456c9e746910144ffb810daa6fd

SHA512
8c8516441f54b657d49022d67fb0d7f05b92e6662d5f9ef710fe6af4ff4918d2f2767aacf638c16658ed9f30515537f08de1c07a98d27e419f3cfaf3f2943d28

Download Submit