32c4cd7861dd380c399f0b4980ac20edc9eba38e98d4c3843e06ec5910b58362

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b68a5ab3f0d6c0e030b5390d731533ac1dd9a7798f5c101acf51d80c7b8dd97.pdf
Size

98KB
MD5

b70a67a6b8dc431a44eac7e66adbe8a1
SHA1

2758f63e30c7d57d37a92ff239c042cc234de330
SHA256

1b68a5ab3f0d6c0e030b5390d731533ac1dd9a7798f5c101acf51d80c7b8dd97
SHA512

4140b233f50436fb45ef7b479b02e4fb0e07975c94656333c5ff862de5dbf9296f7c2739e883ebf09c886c254c8bebc0f6e8a531cc6d0d3eb7315937e2f533df
SSDEEP

3072:yzQetvEez5q+Q5a6CPktaR/hdxj64HEPP5R:yzQeKeVq15d06aRXxNub

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2532	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1b68a5ab3f0d6c0e030b5390d731533ac1dd9a7798f5c101acf51d80c7b8dd97.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9e654145c7db7e8113ebfd062c188960

SHA1
6ebe7797b8d36c18e2d51c4f1e3655555fad4e24

SHA256
6cbdf7cfab2bb0c183247b8a6362ab8f8f20cbbade2bbb03f931993055c3d208

SHA512
bc5cb2cf7332106ec49b680a0b3676e9bbac67f0adeeef72718edf22541bbdbee3f0ac60f56985270074d8779e8d21fbd732506c394429056c147553c9290cb4

Download Submit