88261fbd6027cfd0f8b4bb4d58aeb8a4d1189a2ff0e30def497f1e2abc14bc94

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b40f5bcc6be6308bb5d42a6da147ed22554c7a3672dcc54429e974b767ee93e8.pdf
Size

87KB
MD5

9ee05a5f6f061f07f867ff23f98bdaee
SHA1

bd728cb0ec39aef58bdfc8ac1d4807d9d3a717a3
SHA256

b40f5bcc6be6308bb5d42a6da147ed22554c7a3672dcc54429e974b767ee93e8
SHA512

0923e09a9b41aa23fda6c25a638db3064601f2237d6a435fdee98318f9bcd98f885f2fa6a9288270c8dc7a254317c5d06a3d6455516f88a19e7115a77820239c
SSDEEP

1536:ZM5eNIpOVaAcIXxcX01mp3OAEf+gQG3ZxrqnThZzpWdshw6ZnezuaW8pO7+OamUS:qEmpOaAbXxcX01msAEf+VGJxrqThZzQG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2084	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2084	AcroRd32.exe
2084	AcroRd32.exe
2084	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b40f5bcc6be6308bb5d42a6da147ed22554c7a3672dcc54429e974b767ee93e8.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
64bb604ff856697553c05ccee7a54315

SHA1
ff7456f4e3f9fa8bb839c9f123eca50b7aaf7969

SHA256
85bad071bfe2a3f92fa4bce1d6f4d638d1501c8c1663df7599c6f9fe6d9f33cd

SHA512
62e14a5e9d825c5b4fa2d95a57e89214789b6225a203037270009068df0603bacce2b4732249ae0003a88dcfd4db8b4c7c1b8884781df934b637c485d7cb6294

Download Submit