da7700aa477cf33fa64dc0afad816e2a4ce9891bc45297e17cdd08b3d1582b31

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b4bfcc57c76557e0e928fc4c5dd64ec5c03738d535bcbf9931b07f0ad4e92f2.pdf
Size

81KB
MD5

86ef6f1456fe2d6c8f80fe9d90b9c832
SHA1

bc409b2f54bad5f8139e2185906d7c454d045ba9
SHA256

2b4bfcc57c76557e0e928fc4c5dd64ec5c03738d535bcbf9931b07f0ad4e92f2
SHA512

433c2a768ec363ade095d1a8bda901c4fb08684ee17e006ef2038badcaa0662250637d77c15eb22e43a7bbfc0d2a3a119a5bbe3abc531c70c6086ebebfe3cd3f
SSDEEP

1536:rqbWzhkFjhz+SEE0wWXEROWWBT6HaUh2LvIE4SFcoG0UsBrfRVHo/GYrspX:IW+hzRW++/3co6stXo/GYr4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2724	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2724	AcroRd32.exe
2724	AcroRd32.exe
2724	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2b4bfcc57c76557e0e928fc4c5dd64ec5c03738d535bcbf9931b07f0ad4e92f2.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7ae9a72dc36ee607b4a1a2c253250e48

SHA1
0bc38c3c945f5df8dc4983f9714a42da15db4a3b

SHA256
95a5ff2429d5a456e2c9e08011d2a2078f7f21fa0f84ed74fc1d4feb18616df0

SHA512
b5de023b64a02eaa497e7afdc7108ef70e72459326d2af8cf5a38ddcf6f1c11a6b9c5fdda454c01fcd3035493060593f02394b6abfbfd367379d8c8aea557860

Download Submit