68f7311994a06aa82111444a0736af400d27161f0f41df4344540c857048e385

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d0fc0dd62d870dff7e3de42fc644eb3390d20ada231b4de0669d5aac9fd1537.pdf
Size

79KB
MD5

652d6a5c8ee4a2023f060d84070a8aef
SHA1

91f7a356ecc077f608ddd3b98aa7bfd1b9794e9f
SHA256

5d0fc0dd62d870dff7e3de42fc644eb3390d20ada231b4de0669d5aac9fd1537
SHA512

834eddf3e731fa55c7cf6bbf616bccdda07591aaab73d04d28c8b404e9b9f7a9213ec82a34348599ba5b8d9823dfa35b888acea16382bfe12a1553413fde1135
SSDEEP

1536:txTNhPZACG1qWToCDKpmNT0CcQnb5TBY2+WNnHmmWXpO/+a4:7CiWToCDKs7nb5TBY2HnGW/G

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2400	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2400	AcroRd32.exe
2400	AcroRd32.exe
2400	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5d0fc0dd62d870dff7e3de42fc644eb3390d20ada231b4de0669d5aac9fd1537.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8b105fcf2a246689b8540009ae1cd331

SHA1
54cfdbc3774828add65da2ad482a041373fcb461

SHA256
1776b83ee39132bd64ff15f565f5673dcd22ec1bf479d62ddf97805ebe5d20f2

SHA512
fccc2759672abaf275cd4690f44462cf99638f69978932939be8b535c60b2ec112712594380c643af37a5241cebbf8d9eedd919efd3c0507595492ab7fd1f525

Download Submit