3d80056376d06bfe002af70174ef3b86dfe63eb490b288744c76bc7965ea8d86

Analysis

max time kernel
104s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 08:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7f2d07570e522d0aa1b5302001d1f80N.pdf
Size

60KB
MD5

a7f2d07570e522d0aa1b5302001d1f80
SHA1

b162f623df782fcc88028cd6b52897516292668d
SHA256

3d80056376d06bfe002af70174ef3b86dfe63eb490b288744c76bc7965ea8d86
SHA512

66b841fb5e014319cd370a11f5b4659c6af4b2e3cfff2a15683192da2053620837342b09f176ee7142c9bbe10cc03871f1229c05da00db02850838a6291d5aa2
SSDEEP

768:huzdNIggou41dMV+foYlP13QfX/vKu4XED5vZEIYrAvUbEwapovH/gW60:AzIW1dMV+foY56XAXaVZEzrxCpsR60

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1640	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1640	AcroRd32.exe
1640	AcroRd32.exe
1640	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a7f2d07570e522d0aa1b5302001d1f80N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
621e9e6c106c49705755b4aac5f12ed7

SHA1
d19cde1f85bacd352aef56c7a7142bc91357ce0e

SHA256
f7260963f4fe623d9003b67304358d04dc4a7b11a0d1484adc2b547ccf3fab72

SHA512
56d5077c192279594c5d9439385ac42d7b5fe2856fa9c4ab6d4ddaa20c4b608198de8d18f9ec729838761ac9712d54fe6e6f9693cccba8f80caa3e4e8a7a3a97

Download Submit