8d7572489ff1f4ce11ef98b5a16fb5ee93bc91a576433f0c7a3af8f474444ab0

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 04:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7e030d6a804e944e6873553894451430N.pdf
Size

55KB
MD5

7e030d6a804e944e6873553894451430
SHA1

0f0daced26d9d3f7c9c803651bdd0b308393a790
SHA256

8d7572489ff1f4ce11ef98b5a16fb5ee93bc91a576433f0c7a3af8f474444ab0
SHA512

a28eb39383b3b133c37022e47127f68811c2d86e8996e3b3bcfc59d9f41bea19cffc076b199126630f44c9f3fe9890fb8013261ab902c01d54f1a1d483aa0b5a
SSDEEP

768:8uzdNIggou41dMV+foYlP13HHOyzYq++J7A+IeEs/y6u8/z9+5NmnH474:/zIW1dMV+foY5ZOyzYW7cebq4+5GY74

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1852	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1852	AcroRd32.exe
1852	AcroRd32.exe
1852	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7e030d6a804e944e6873553894451430N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
07e8eac6d01f15c77844b9d90bfed5fd

SHA1
c22997c37f7c893bdf52ac6aa159c305500ec96d

SHA256
088ff42192f4c16f82ec7f563a40bd6308edc2d5672223e6ad9c4d77257dc2ee

SHA512
30c51ec5e1b32bde08ebdae50038525febf1de1c339decc515c93d1584097739ec693262f0365279c20a05cb1984ebe8d5d04928a7e1faaa1ec698ed727534f1

Download Submit