32c4cd7861dd380c399f0b4980ac20edc9eba38e98d4c3843e06ec5910b58362

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b68a5ab3f0d6c0e030b5390d731533ac1dd9a7798f5c101acf51d80c7b8dd97.pdf
Size

98KB
MD5

b70a67a6b8dc431a44eac7e66adbe8a1
SHA1

2758f63e30c7d57d37a92ff239c042cc234de330
SHA256

1b68a5ab3f0d6c0e030b5390d731533ac1dd9a7798f5c101acf51d80c7b8dd97
SHA512

4140b233f50436fb45ef7b479b02e4fb0e07975c94656333c5ff862de5dbf9296f7c2739e883ebf09c886c254c8bebc0f6e8a531cc6d0d3eb7315937e2f533df
SSDEEP

3072:yzQetvEez5q+Q5a6CPktaR/hdxj64HEPP5R:yzQeKeVq15d06aRXxNub

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3060	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1b68a5ab3f0d6c0e030b5390d731533ac1dd9a7798f5c101acf51d80c7b8dd97.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a3fdf7d6b54d32960fe92bec10fbcc21

SHA1
6deec32dcd06d32b393b2643c41f539bc8bc0a2d

SHA256
4323e42edab252eac6c381fcf991b3c74656dbb6b6cd548f4a63f4eb2ad2a715

SHA512
a7efb9a8230d1d733fabf072ba69a6a67d9bd355e7a872ba52f703efa6de9552b13b9d2ccb2bf2e0778e542e1e923acbd1e3386ac7ff9a0c0d3fec44cb655ba9

Download Submit