da69d1eda6da4fcc804ab8146cb4f2bc79e0dd2a831c87deb8d0d094d16ee1cf

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ad6e3a24a37c75f86d5a0bcc41da0ff3478cb0c145930ce84ade6d4840251ef.pdf
Size

35KB
MD5

7d2cd46a03b10bc93e7ee8b2e9e6b361
SHA1

c5362d00a7871b7dd70fc5b7607b0744468f969f
SHA256

7ad6e3a24a37c75f86d5a0bcc41da0ff3478cb0c145930ce84ade6d4840251ef
SHA512

8d46bfe5fa40441c73b911fe500bf3c247b25ebea4cbfe9e81366f5cf18186fb4a5e81eb91b264d39d024e37f5f89fb985e47c5a04344677b390da59b67a17af
SSDEEP

768:yxLD39hDGvDFX3iFVpx3t8OtuvV4TQrQudMTsvCeX:0DraFCd/TQS8rxdOsvCeX

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2824	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2824	AcroRd32.exe
2824	AcroRd32.exe
2824	AcroRd32.exe
2824	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7ad6e3a24a37c75f86d5a0bcc41da0ff3478cb0c145930ce84ade6d4840251ef.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8030a122931b2654422d40db09242195

SHA1
9e4a64c3ccf9b60659234cd93dce27fdb9de433e

SHA256
de5859e81c00f1d6a533f2b4992af21bcd03f86f892beee5098bff38d812596d

SHA512
9e92cfc9ed4aff43742280d9dd6924dd6227df5a9aaca355075ca6410ddede9873263d92f377a71b3cb66316a34528eaafab2c68d622e847d23b0876ae95a438

Download Submit