9ea80e578b1fbf23b973a215a687c9eda50d74339dc257918a3493a16e5f8482

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0f1818817433668568e7fd97398c050fc7c19e5ae85dae5d12e75c315333f3e.pdf
Size

85KB
MD5

39ed83a871ee01eae2ddbee227b0c93a
SHA1

bed38da2ff1ffa39d294518bbc26088573f62570
SHA256

f0f1818817433668568e7fd97398c050fc7c19e5ae85dae5d12e75c315333f3e
SHA512

d1880eff30fc0f889800b66910a6768d3ac138c5be1a14a95db617bc75f1539ab79b7e02af84e6d5efd4c6e4002da7b077878381ed52c754bbc2685c10c5deae
SSDEEP

1536:k+gf8e9g8khxy24Zs/UoA391uvJM95ic7qxKZYxT7UocbzbNWqoW6sjIa/j3sWOF:7gf8cqryNJ3+M95i/wscocbQMr3ZZW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3044	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3044	AcroRd32.exe
3044	AcroRd32.exe
3044	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f0f1818817433668568e7fd97398c050fc7c19e5ae85dae5d12e75c315333f3e.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ace45cb9463048e5112a0b8105e3e5b7

SHA1
965fbf021b88759b052dcb0508fcc41a35b79eab

SHA256
74abf554b9060be0c2cd8f1a568add2f7ea56013c365598f97666b806c0557aa

SHA512
9f7e2422d921c43bc67ab6d2bd842353b8ddee48d1c350d0fb5857ac4e3f24759b6982a808cf0ebc815e8a6b94f68e1f1f7fa54e28c4c6b6cdef5454ce1da08a

Download Submit