9d93fd5bd9327aed4caa59706d62711c8b28244a5bcf4f9f6c2ff60d0a3a2b49

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

228512cbfe338965d10b372ed4f9b250N.pdf
Size

57KB
MD5

228512cbfe338965d10b372ed4f9b250
SHA1

a80950fdbf476c5c786b4dcc16f4ab9082b14a56
SHA256

9d93fd5bd9327aed4caa59706d62711c8b28244a5bcf4f9f6c2ff60d0a3a2b49
SHA512

5adb6b3b3d7a771ed1ba681a6e37ce4fcf454b8cc602c668d04ef7fcaeb9e447df3dd082c477483acc00b60d1cf51fd9e0f42c80fd61b1f611606805d04811e9
SSDEEP

768:hquzdNIggou41dMV+foYlP13fJYtb//S07FNmxsixCOcI+M1DEP:hFzIW1dMV+foY5Qtb//PNziH+M1DEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2276	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2276	AcroRd32.exe
2276	AcroRd32.exe
2276	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\228512cbfe338965d10b372ed4f9b250N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a0401703e14ad97a527e99410285f3f8

SHA1
aaaf6405ffdad1d27997aab589c48eb19f1be2e7

SHA256
0593f31af05303382f4e24a4158f30e6c0e362d1150a567188813d75e8d1be90

SHA512
026508c532a7a2bb44b7341d979e87571f2169d4a1a1d5cf89e0883690257be50bb40b8422a80647897cc1c6a215f3dbcdadc3f8e8095ed1d14ad88800fbb986

Download Submit