4ca35d32da4c8b005015dac2a34934cbeb0b09db045bfbf12f88e08c88b1c8b4

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fd84f65b7d1a14a060521098f483362ebbacad9740b17db112a064a9e0343fa.pdf
Size

100KB
MD5

433e9e8cf8df287832dd7bf73d5d3a40
SHA1

4baf28e70d30e1dec0004503fd202fd6f4113505
SHA256

5fd84f65b7d1a14a060521098f483362ebbacad9740b17db112a064a9e0343fa
SHA512

1ac7ea492ecf54e4996518dfb75297854b77c1f24832e729525e9680af62c925e86bf5ea6b13aa39ab8b230f8214d5b6077ff22a263de46f4ff957bc8b9ef648
SSDEEP

1536:hRr4uzH0L/LCJnJbEtSMWzkNbwJv+x6xnRC5cZT8hOm1xWM84zczKWGpOGPg9:7fzf+WzkNbw4QB18p83Gi

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2116	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2116	AcroRd32.exe
2116	AcroRd32.exe
2116	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5fd84f65b7d1a14a060521098f483362ebbacad9740b17db112a064a9e0343fa.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f386d53e38d02cbbb1666c7108d61fe5

SHA1
5f876e3a33a615ca4771ac9fc5dab62c8f8f650e

SHA256
3e117ca8c0d2740890d12c1d6d2b52b1be01eb07a3b1fa1620ced822012c171b

SHA512
5b752575bb8fef496ec79d502cfbc26e00156a18e53712c38fc92949812f3d89e73f51e89a7706deca5c60c96814b059ffdbd60708f70082920211776c8546ac

Download Submit