208837d98b682c3fb0457e77595da8900ee235ed3c6692820c61d50a3674a069

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03f5026dbca76b1f0455be153c0019f0N.pdf
Size

64KB
MD5

03f5026dbca76b1f0455be153c0019f0
SHA1

191b60b47a1f55f31f5b6ac4c1ff0029de401c61
SHA256

208837d98b682c3fb0457e77595da8900ee235ed3c6692820c61d50a3674a069
SHA512

85ebc43b864ffad3a68eceb5155f2bdc075fd36df61d2535a7b39f3c6d77eb66a179cbab6b124a243b2c41952a2ad719acfe041b084bc31a488810db6d1ed756
SSDEEP

1536:BGFu0RYGDKHPBQxoyX/YBjSpSc/ue7H0tTpdXSI9eIp:kFuTiKpw1WO3ue7H0tTpdXSI9z

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1088	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1088	AcroRd32.exe
1088	AcroRd32.exe
1088	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\03f5026dbca76b1f0455be153c0019f0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
880c82684202681258b96dd699c56c76

SHA1
968fd4db9bc913dc55be00d5edf12af47005f562

SHA256
cf36c45049c43b5fa0ed74f710a2b42c172137f64a5da0716389617ccb210e6d

SHA512
e7a6a3653cf7136f7f1945e4b79628956cd6dc45bcc691885e3ef87160d0a5d7d0e5cea8d19fdfb9428d48fd3205dca2ad10f068c7d737a748445827511bcb0a

Download Submit