1065b70db040cc1b7d7f1c85b8648e7a3f8fffc5c68df45f682b533434e60358

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1065b70db040cc1b7d7f1c85b8648e7a3f8fffc5c68df45f682b533434e60358N.pdf
Size

3.8MB
MD5

de7c3a976daad1e530b3d1cc85104840
SHA1

bc4f4f2862b000d759a2d24239ea086675b611ac
SHA256

1065b70db040cc1b7d7f1c85b8648e7a3f8fffc5c68df45f682b533434e60358
SHA512

5cb5d35c95c5ca9e2db0ab00ea5eabf3f458b851712730de7efc87a30eb9e60d1d17a062eb7db780585f20a7b81291c8f1e713f8143f728d51b4e9615291940e
SSDEEP

49152:H70jvxkqhe9+vE83OxxIvyrkzs61u+1pmD2XYA9EeXyPx2bmYug7fH/QOus7AE7+:YvxzVuBrkYOptJyEbFu0Q/s5Lbeeq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1968	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1968	AcroRd32.exe
1968	AcroRd32.exe
1968	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1065b70db040cc1b7d7f1c85b8648e7a3f8fffc5c68df45f682b533434e60358N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1a6d50fd10a6af71d510b5b9442c94ca

SHA1
dbd1476b334c58a85a6e757f3e6be203b0c83343

SHA256
f3a653f30ccaa8cc326dec77a18aad88456fc5f050ae54bcf210746458c2a6e7

SHA512
78e0790dd647efd6ed4b2b21170745ae6f6b70b1565bc1999a81b473739adcdb58f2ee9a294ef8167c9bbf1e9ecb13c6b9d7dd07d99a97cf53b36d44a30a64dd

Download Submit