47d32371370954663f9a46ba1668e09b44fb3923c4bfaa0f74c795acee59c4b0

Analysis

max time kernel
95s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a6736d281318adaac323c310deee9e0N.pdf
Size

397KB
MD5

6a6736d281318adaac323c310deee9e0
SHA1

91404f97337e204f538c31f92e71b640cf9fca19
SHA256

47d32371370954663f9a46ba1668e09b44fb3923c4bfaa0f74c795acee59c4b0
SHA512

7d7e4fd46d09c328489d82b8d3c2b9658d63982aaaecb7496c28950ac3faab5da1cf1b6d4fc0aebccc3ffa3578ccc86b432e9d41de18ab58fb4a4de2c7114716
SSDEEP

12288:VvQvA6QJjaAfTEO1YtR7ekumRMq9uG2EbW9:VYv3caAbEqtbq9u9b

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1424	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1424	AcroRd32.exe
1424	AcroRd32.exe
1424	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6a6736d281318adaac323c310deee9e0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
219b66d2a9e4caaaac6b6d524a740aa9

SHA1
834eafa55b01c9cffa028f581292ae11da2eff5d

SHA256
7d53d7b72cb21ff2468f5d1bc43daca519f2f18858a162bce97723d466b448d4

SHA512
428c0e6e5258e66bd816a5068aeffa9b0f63d64ad5679aa507b93be370f1bbaddea92a231d2ea625ba627d79f6738db875e05e2cfc337f0462d7b86180c5f112

Download Submit