86a72f496046f256c07e989755115abf22f0e87c70df8aa4c218fe1aea714015

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a0a9a8f3a824a908175d98ede748b0c052961f5f27fbd61033766c8556074f2.pdf
Size

69KB
MD5

00b4ef8bfe8decb07eb828306f4a3106
SHA1

fb75b4396722d7333bc5e7b179c038b0753828f8
SHA256

2a0a9a8f3a824a908175d98ede748b0c052961f5f27fbd61033766c8556074f2
SHA512

6bd292ac59d2f71250fdb3f1484f6bdb9764a9ee69170a74d145543bc4206573ac998242857e3b3141fc53c12f0220a4e8fe4debbf00e2f7f3d2ebb32575cc83
SSDEEP

1536:xXtAVroYuP4FwcHlUxnHcaFiNFKm28WOpOwrgEWN7JCi+5NVyXm:DAVEbnLFiNF6ZwrgZJgHd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1976	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1976	AcroRd32.exe
1976	AcroRd32.exe
1976	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2a0a9a8f3a824a908175d98ede748b0c052961f5f27fbd61033766c8556074f2.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
972c8142a711a0774e4ce779cb039b89

SHA1
24e56d5bc0ca5f661551a4261b19e8c4b5cb068d

SHA256
2951141bf06c18e55a0aada8bfef5b02c8abdf60cdd84007afa45b4ddb50517e

SHA512
9caea17c020caf6b089efb8e1ce4c059396a7e5d0edb4ecf85d5a706a6a03dffebdae602e7669047195fd588a37f60bc0701d5939d3e088250b1dacc8e8b8485

Download Submit