6bf4fbfc279b0dc8fcb34b9c6083242daf4a7152687c425dd6b57436f25e79d0

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ab6758c98921b79dfb661238f0da850N.pdf
Size

340KB
MD5

0ab6758c98921b79dfb661238f0da850
SHA1

16b455373776724cdb48a6fd07c7d372a1e98912
SHA256

6bf4fbfc279b0dc8fcb34b9c6083242daf4a7152687c425dd6b57436f25e79d0
SHA512

ba2d139ea9fc027bfd88511b5fd790e68da08348f355b524a240e1d9af139764127cf6ff4c268371011532d6ce1fa3b60f9567e39734e7858c92408d5d842be0
SSDEEP

6144:A1ST5DOasL9dD4Lu40WNI+hpw7ZFJIirCvemTMBQ2K3Z/bD0FKA9406JRYy:BT5SasL9pA67DJ0mmPxbDx+GUy

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2568	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2568	AcroRd32.exe
2568	AcroRd32.exe
2568	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0ab6758c98921b79dfb661238f0da850N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8ed6cecdf265817f6727c9424bded985

SHA1
1e220686cac6819e9cb1772adede4bcaea68dc67

SHA256
d92a34fb1664d7460523f4b189f9b315a4f39363d75cd89bb05627504728d7b9

SHA512
b9f94c53207b92fd7e26a4a236e7efd41755bacd80d5245e1325b1e21595083571d1e63415af1891e8ebad10974ebb1301668c647f41e54389daf0cdfef33a9b

Download Submit