5c889286b7bcbb7202917f8549604a58ada8404b029a8da3cb4198aac745a48e

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c889286b7bcbb7202917f8549604a58ada8404b029a8da3cb4198aac745a48eN.pdf
Size

74KB
MD5

dcfb285d8b9cacbc97d098d2b2cd2c40
SHA1

cce1ee950da9217835e0bb1470bd1b1b0891fe8f
SHA256

5c889286b7bcbb7202917f8549604a58ada8404b029a8da3cb4198aac745a48e
SHA512

1bae27327763565aed02e9a3eeb88b1a20856368c55f7c7dc835165a47699abde2a42ecdacdb285e6f11159f61427bfb964690b88abb13d1f38103f70606d15a
SSDEEP

1536:D4+ZCI8/yhoeFm+dxHtPE1EmB5sTeiPZ6ku9aMczHVHH1S/3AMIAYT4rn8jhjEr:DYyhoeVxmpLsxPkkuIbVY/FIAYT4r1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2316	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2316	AcroRd32.exe
2316	AcroRd32.exe
2316	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5c889286b7bcbb7202917f8549604a58ada8404b029a8da3cb4198aac745a48eN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
beff2ac8c8a00ead2865f1a0298ff707

SHA1
ad9fd9895619425dbc3c3e549abf9762eb6a6f14

SHA256
d5a13fc7a50eef17df3df8852ec392fafd01b746b26f1e302949e55b4de3a6f4

SHA512
cf78a96e746355627d51b50430d92996155945584efc9175b8837f9bf8ec6d9f5f25f4debd38669ddd9c55d0ae89a4fa0357e65c1dfa5bce06952500a4f407a6

Download Submit