dbd20837de9181e14e650d7a68c4e3d20f3c8a92e84b6630fef9d391cc7c9457

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42ff50a66111334d4683f64256375bb0N.pdf
Size

79KB
MD5

42ff50a66111334d4683f64256375bb0
SHA1

4c97a83f57165e60cce2c90f3bb5c0aa927e9223
SHA256

dbd20837de9181e14e650d7a68c4e3d20f3c8a92e84b6630fef9d391cc7c9457
SHA512

c75eb06d2c7cabeca5350b6bdad2540490e9b8d3c01ebaf2d4fea8b61de4dfd1defbf58ff050bceadbcaae8b0fb3a5345889d5133423a866afcf38841997f911
SSDEEP

1536:Cf8pRnu2LfsoxYAPNqAbniPTNMzaYrvO0HDV8WAIw4yrUBYPbWXpO/BFAi4a:rHnJVxJPN1TUTNoaY1GIw4uTP9/Bmw

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1184	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1184	AcroRd32.exe
1184	AcroRd32.exe
1184	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\42ff50a66111334d4683f64256375bb0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ce387a50739213c181b1e409314dde61

SHA1
a9346fa0f959bb7b1c323f064d4018dc5434618e

SHA256
b811873d59bf8425d6be92386e90e66e80e7672ddf47d7f04b5aa502ca1a7d5b

SHA512
ad6188be389ffadc1e6bbff3dd1e5db8b7fa09b447fd83f18555931b85477728fb7bac18d65d86cea5994d1b6ffbedb323aa66e5c66faf0428b10216bce77d9f

Download Submit