3fdc0045fec7f4a21eccf4165272198893d78f13c8cb845a0978c0ddff8577ef

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ebd34382c32d40c193f2cd4dca60a00N.pdf
Size

47KB
MD5

2ebd34382c32d40c193f2cd4dca60a00
SHA1

4d46d4ddffe95e4f7c6116f7e02b47c4f1393d7e
SHA256

3fdc0045fec7f4a21eccf4165272198893d78f13c8cb845a0978c0ddff8577ef
SHA512

a7013e96ecf715e15ac66f8e323550e10e484aa7c8a8baaff8b18f9eec41a728360fc7891d4adae0787b448e60c29f92d8fa4338199057a0e8767ea6ebad7727
SSDEEP

768:pTTiNgJ7iZ+eq3SYUfivg+iATdGtlggHFVPnhwYRIIIIIIh4i2+XBZYxYKgWfU:5TBJ7iZACYLhJTd8ZGEIIIIIIhY+XqU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
300	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
300	AcroRd32.exe
300	AcroRd32.exe
300	AcroRd32.exe
300	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2ebd34382c32d40c193f2cd4dca60a00N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b3c2e492371a8fdcfa1762ec17a677a6

SHA1
534bedd84f351c756e9d500d7ba39d284a5f3055

SHA256
f66b67f0175cc9f465a5d812cd4332268ee422dd4477d1d16a0823109631e3a0

SHA512
27884d06e27fb4e977758333a3cdfd1d8c7abc958eaae9135ba3080471626e730226c9db57f41fab86e8c5f298a4ad30a43c007e1213a553d592b8da5eca5609

Download Submit