670ce7ae3975c79cfd355a56258839a1b1ca5e4629f30c7b4337947cdb9e68f9

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

670ce7ae3975c79cfd355a56258839a1b1ca5e4629f30c7b4337947cdb9e68f9N.pdf
Size

4.5MB
MD5

2ef82edcc3c337f4cf027f97a7228040
SHA1

0915c8cff89aae6e2f3fb4d94415e6bbd0e4e0c6
SHA256

670ce7ae3975c79cfd355a56258839a1b1ca5e4629f30c7b4337947cdb9e68f9
SHA512

553005d9e05fd1f7b64364eb93cb286aed7c67a4f7bdee8a0927c6b80b5accc8135fd7fe9ec21b0a04527713bd72e153c58792ba2929b7dce919f152505dba1c
SSDEEP

98304:nV4w29OfL5zcM6bUaUPxDTQpMgkL5Wok/uytU/cX7sPBsuJbMgzdvVmUK2:ewIODoK5W1Gy2/QumJ2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2072	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2072	AcroRd32.exe
2072	AcroRd32.exe
2072	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\670ce7ae3975c79cfd355a56258839a1b1ca5e4629f30c7b4337947cdb9e68f9N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e8a9f7f325adc18359393dd61bd073d9

SHA1
5daefb5cd50b917009bd6c47534230efea248d6d

SHA256
b107ac2946ee157624ad13c02637d81a0bcf770066630fe6001dd9d3de642345

SHA512
a271cf1bfe6dfed722f63aefbaadc847b9b1aea055f7ffe2faf4346004cea5736ae11b3185d8586eba6629ef4d65406077d65803cadb197887b06e4880959a28

Download Submit