3a6c2ab72fe2b0fa87612ae1487c5496552c1620f921022cae7170348a61aee0

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1e27bbeeb71fc59475b3c1e524368c0N.pdf
Size

81KB
MD5

b1e27bbeeb71fc59475b3c1e524368c0
SHA1

d5562fb4b3ba2ee664c70a48b64bc037e73dd32f
SHA256

3a6c2ab72fe2b0fa87612ae1487c5496552c1620f921022cae7170348a61aee0
SHA512

23c9ac8b63b8bf7bb54f0d47d9bb9944d9e38a935216044751e02c264eb926097b1bc2bc9c6fc470b0962795b0053f8f9583c759bf0360be4f04761be67bd299
SSDEEP

1536:GbIqP/qqlQlL73Kk/+8ufGSMG40/LwO4qJ2OWAvHl+7ygIY6Q8t39CLhwx0wp+:4H8B7ak/wGEPjwO4qJ15vH47ygKD3i

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2320	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2320	AcroRd32.exe
2320	AcroRd32.exe
2320	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b1e27bbeeb71fc59475b3c1e524368c0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4d9869f19bbe473189278cd7e9ef20ab

SHA1
4df4b5047521d2380b7127830f828f02a2db5cc0

SHA256
f8b21f308d5ffb679982b07e739af067c270e89729cd14ffc9ff5241f6e1d086

SHA512
a8bf6374c430691d8f588a0c89afd1b1178e462151fcbb89a62e3d22b7d7613349b2ca2aa246f687aece43dc9e3ae18e5aaf7dba63094e4a83076e788c0d5d0f

Download Submit