fb11d3dc9676fd97e7f8fab9bdb579296a3893ee1a53a685c2fdc297b19bcf4d

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d8e190e9cb21c515da92dd467fbb3030f737105ab45c93b682a9bcea446ee3f.pdf
Size

79KB
MD5

b652015215c00329e420199592f54d80
SHA1

ed9f2e55b1ef9ac966087af62f2cd85330d813ae
SHA256

0d8e190e9cb21c515da92dd467fbb3030f737105ab45c93b682a9bcea446ee3f
SHA512

0d695ff86f0e80769ce18adcce731a080946837d709fcaa768410d071a6febfdff340421d19137a0f5e9c7a9df13146b698660c24c3a24bd7e148e9572e97fde
SSDEEP

1536:cQT0OPQXLG5tyb59RjzAJjqaTBscEDSWfDWg61377AUmZjbWQpOCN0rX8M7Yh7:70OI0obXR8LTBvOjfhwXTmZjGCGD8M70

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
768	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
768	AcroRd32.exe
768	AcroRd32.exe
768	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0d8e190e9cb21c515da92dd467fbb3030f737105ab45c93b682a9bcea446ee3f.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1e8fa7af4aac778e5d0a38fd072ab573

SHA1
5c960019f73cb4209d17f7c712fa5d7f390a38fe

SHA256
95ed00ee67ab7715ed2a8cdb2944fae5c3acf0354363b72a2f6d6917f9a4c44c

SHA512
d8c745ab4aa6261ddc71a0bacfe38284a130fe473cd1a81a26bff9a6817d9c2dab329d4aa2615e1dcaa06e6af89eb9563cd71f251f937cfd62673df670784cc0

Download Submit