e4ea9d9edd0f53fef9681870271dbe174e1e344019b778b0b601e1d3b3d9abe0

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4ea9d9edd0f53fef9681870271dbe174e1e344019b778b0b601e1d3b3d9abe0N.pdf
Size

160KB
MD5

43cf00455e5a13bfc6e76278efd2b220
SHA1

1332f8d457860d8c9c539f4ccd2a343592c4ad28
SHA256

e4ea9d9edd0f53fef9681870271dbe174e1e344019b778b0b601e1d3b3d9abe0
SHA512

b9b3b78f143e0311c5d0bcae992ace72ed2c3a5974a01fbf1e76abf8178b2498c8a2678d2c5b4f74867d24688e4cefe491105d187d8b8ab4a7a7ddb9072daf70
SSDEEP

3072:3hWet6dSAuwxFtaw5W1V62fMqdhtEeCyK:38aALxw1V6QMqhSz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1364	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1364	AcroRd32.exe
1364	AcroRd32.exe
1364	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e4ea9d9edd0f53fef9681870271dbe174e1e344019b778b0b601e1d3b3d9abe0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e051395e23f2da39679bb5698cf54543

SHA1
5f7d0d93d74859eee5733d4d0dc297746732f08f

SHA256
91802b99fe74d7197542f7a8d70b12b9f05c7f190f3092344f290a3ab5eab742

SHA512
ec3ac6645efcf910a6a980269d04f81ef4cf18ae21d60bff9c5db606f41a5ae1256cf3fefb824d331eab6ca85c04533bb4fe800db8ac348c182836461c1dfb57

Download Submit