047266581f09e56de9ab2656f84a7f5f94a2c3613357db286e00bbead427f929

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

047266581f09e56de9ab2656f84a7f5f94a2c3613357db286e00bbead427f929N.pdf
Size

77KB
MD5

189254199ef1f758d48c29c3a301f5a0
SHA1

362e68e7149186860155fdbad8c59c8e88ed7814
SHA256

047266581f09e56de9ab2656f84a7f5f94a2c3613357db286e00bbead427f929
SHA512

d9422d7b72054ccee934a34e92e714ad548181ac7ad5659dc8d2fc8d355268c70850d3774be4ebd1b9deb3cc3bc621748ed88fb3941db4896b02a89da7f6e1f5
SSDEEP

1536:MdqGVLo8t4ROtfLm9TnOXCgDF2222WY2uagXR3GV+:MdqGVktAtyOyusY2IWV+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1884	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1884	AcroRd32.exe
1884	AcroRd32.exe
1884	AcroRd32.exe
1884	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\047266581f09e56de9ab2656f84a7f5f94a2c3613357db286e00bbead427f929N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
af0d405a10788c1a6c6cbc218309306f

SHA1
79dbbd7d1a75401f0ed9913b234f11cbf219465d

SHA256
9949cecc74b4918818ad05f466a0dd6275a5f57e793a8fda54fa75e58e32dbea

SHA512
9421b516d5f982c62dbb11acfdad6777a10179a90563d95238d74e8d5ff82748dc5128686eb38c626d30dc01465a04e82d0c1173ad594f77a2c9b513be5ceb8e

Download Submit