b0fa4bb1a0fb551dc89e9a335e47c9ef612f193dc50f165fbdfa548cf4eac97b

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-09-2024 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c0a6085888738931330bb2354f22850N.pdf
Size

59KB
MD5

6c0a6085888738931330bb2354f22850
SHA1

0bbbba104c067d0a0209fe21a4d029aabeca80db
SHA256

b0fa4bb1a0fb551dc89e9a335e47c9ef612f193dc50f165fbdfa548cf4eac97b
SHA512

e7fa8afc15ecb2ba8092a6dbd80794412929805e215f1836730fca662ded3c34434f74152035ff4c8c87d9483b8ef875350e68e23683dcb5e3a02b3fd266fdd3
SSDEEP

768:5uzdNIggou41dMV+foYlP13Tr2CqBPGB2nKhxMJ6PtiLkB+ho:YzIW1dMV+foY5FktGs2mEINho

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2404	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2404	AcroRd32.exe
2404	AcroRd32.exe
2404	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6c0a6085888738931330bb2354f22850N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ff1bad5da441d29609d3b0fc92866b77

SHA1
1fe4475d01db3ca1d04518ecbad61a8b9a90b758

SHA256
ac01e29bdab6a6cb1bc5fffb44ce2efc2c1d3f83d5ba4fd60e9d6915c10a577d

SHA512
0f8837000fce591b7e91a7c8962180ff3978e728e0cffb9e8f931071f3dc7c8d319b2a933cd845af59abbbeb9f56a56ae3ff759aa22e78896a4663004eb3df88

Download Submit