6e1687a6602d2a83cde3f5fd0a6fee733481460a82cd31dd1d9b5a9c1954003a

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d655d0407ba730b68dc9cdd8215cbc0N.pdf
Size

72KB
MD5

8d655d0407ba730b68dc9cdd8215cbc0
SHA1

411a1843ec214078b96ae0cc1e6783608f50b465
SHA256

6e1687a6602d2a83cde3f5fd0a6fee733481460a82cd31dd1d9b5a9c1954003a
SHA512

79da930471769f619c7eff5e664478a33c723ce13f690d7a34b45369e7c881c46e3bbb01bc2a304a9947ab1cbdb1a1971857ff991b26fd963d6cdb4edec62636
SSDEEP

768:9pFp4ibIL+uf1LV/A4djk7uLBYg4xmHKvhJX+kv4Rj8AqmFda8lTx7YFq87fu8WL:wF+ufHTdnKX+JAATHDTxsI8crcNh41FD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2468	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2468	AcroRd32.exe
2468	AcroRd32.exe
2468	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8d655d0407ba730b68dc9cdd8215cbc0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fdff310fc79e3c8c7fc7a8360c05b814

SHA1
f56800c3acd6349a32d2518694bfca5e034b4f74

SHA256
b25fc5c28a2ac96ffd99af23551b88d78758d7d7365c0097e316ec29006fbc48

SHA512
1b1842210354e74c36379273bc61c4d1a8faa33c3ac6646562bfc521a39318c4bb94acfd2ef65ef2bd9e57e32adb34ccbc02a8a22a8ea2f1df386be3d1c6ec03

Download Submit