d6bf988b5f4008714e35453ace56651a94ebdd58968bff4006908dd5690f090a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57f01a53dafd5a7fdcd7808545cfe490N.pdf
Size

3.1MB
MD5

57f01a53dafd5a7fdcd7808545cfe490
SHA1

6737745ecbd104163978663a5009b03946c2651c
SHA256

d6bf988b5f4008714e35453ace56651a94ebdd58968bff4006908dd5690f090a
SHA512

683ddac193aa15a2f7dd2b4a52df88162c8aacf590f5cbe5797b0bf0afa3ac0afda495e7eb6939c800a2f4d51f886bfcb7ac9c6cbf615cb0501ea154bf8f04b8
SSDEEP

49152:tsP7wYQY5+E/REpDKxlMlggzQIaInV7fiFSisP7wYQY5+E/REpDKxlMlggzQIaI4:K7wYpkHpulMTzxn3H7wYpkHpulMTzxn4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2844	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2844	AcroRd32.exe
2844	AcroRd32.exe
2844	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\57f01a53dafd5a7fdcd7808545cfe490N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cf67426c2b7cde5e66c5a43c799f9f4c

SHA1
e956bdf354e26e0d850ba9f5630a3323993ebe25

SHA256
596870e95e6cb047af9d4029805685beab8f2036b0d591c68166c9a58b37761b

SHA512
0d9fa98b4eaa7d873938de8fd8ff9bb2a460c830939e2c518c074bd9602f65c1845d5f9807aa8003052aea3030b172dd1dde868e928abeee6a8d0d6d41ab0694

Download Submit