833ca55a4c778593fcb98b97e7aa788acecdfb0fbb604fa5a1da7b1fb6bd9c41

Analysis

max time kernel
100s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e86bb7d5668f68c0c5389b8d76e80d0N.pdf
Size

64KB
MD5

2e86bb7d5668f68c0c5389b8d76e80d0
SHA1

6dd1738ecfad9d1b5e4d762a5d5dd32bdf11abb4
SHA256

833ca55a4c778593fcb98b97e7aa788acecdfb0fbb604fa5a1da7b1fb6bd9c41
SHA512

935a6401a101596ec955d9223f4c61367bc177d8035f52ef0da2c5240250d63de4985d2b4ee698ca27e4aabd00fb42c16b720a2b445391f97ba31715c0317ca9
SSDEEP

768:SH3xKsyguhggc5VKyV9YYdIlKiHp/D6faYp6pBNVvkxuHg726NNQf0oQucG2SOcz:DggPFHprYSfSx26N20oJf4Uyut7Z

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2380	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2380	AcroRd32.exe
2380	AcroRd32.exe
2380	AcroRd32.exe
2380	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2e86bb7d5668f68c0c5389b8d76e80d0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6b8856f72b34f73cd5bb045694a246c1

SHA1
6d7c3601900798dd2e3cb06655f460d8f6f38682

SHA256
19a0e4a9878903677de7f38e68952912a45a91c5ffb1213b0163e28e85d46fe3

SHA512
727fcb50287ebd485a0070fe29d699f6cc28d1aa61c5e08b347b45716be5477c36c9e00b8718afd168a53f8cf89e0f7124049bfe8b83e4a8b6cab02b50f926dd

Download Submit