12cb697c28bdab630d7c579201199d9e5b945d51f4ee49d0133fba7e5579f70a

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e15f7ad7b5e9b945d8ea4c17ce88da0N.pdf
Size

58KB
MD5

6e15f7ad7b5e9b945d8ea4c17ce88da0
SHA1

5a5d1deae6f0ac2fe4b197bb78761212b7297afb
SHA256

12cb697c28bdab630d7c579201199d9e5b945d51f4ee49d0133fba7e5579f70a
SHA512

111e54f20945034ba963c80016232313bd97749396efbb64dfac63f11a93a2883dac8f81dfd8bc659d7ceb3a000760aad99f09047e29813b0609495d27e14b81
SSDEEP

1536:bzIW1dMV+foY5JqS+x3cmPYnqXBLnSI5iY+f:AWHMkfqzdzAnqRLnSGAf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2400	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2400	AcroRd32.exe
2400	AcroRd32.exe
2400	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6e15f7ad7b5e9b945d8ea4c17ce88da0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
408542190ed6245ce8ccafef18786704

SHA1
5430121dfc1ae8f1042d515d83ac433b85fcdeed

SHA256
148b754d9ebc1b584e7d254789303f73864c74a18d42069387d2cfa00387349f

SHA512
52b3e5c867675f56de0ccd24ce9c83b43be39f8c91899c3ef6969954809cb8fce74553a63b5f6ed70d081d2cdc9dc76845c359920effa210f2bef93dc9db52f7

Download Submit