827170cd319736b8491369c2a015cda9b9f69eb164cb554a9c48fbeb37dc7219

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

827170cd319736b8491369c2a015cda9b9f69eb164cb554a9c48fbeb37dc7219N.pdf
Size

1.5MB
MD5

8bbbaf25dde93f8f7696998a47c04600
SHA1

93db6f92e26f9223a272081a85b7ab8d9035e2e1
SHA256

827170cd319736b8491369c2a015cda9b9f69eb164cb554a9c48fbeb37dc7219
SHA512

0fbc69a1e7390c012bb29230714148726651c32a4336842fcdf1888fccf50df20b5cb74550b7b2565404175dc2b8fc16935c437b23490e143776b410729c895c
SSDEEP

24576:qzkAp8VcrKgC9y+sLu76X19UZ892CGKY1C/IuYaHOrm+kBu9scGXY/kMN1S6JCCS:aklc+HQ1mZNCkaUrrUuM6r4cA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3060	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\827170cd319736b8491369c2a015cda9b9f69eb164cb554a9c48fbeb37dc7219N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
feec8ffae97305b9e9ac815fbe677d64

SHA1
db6c29027f78858fc1aaef8a40e1121893054c9d

SHA256
616e88f4944a59f67736e026ecaf3827d029850478750e66c300ec74ef20e57d

SHA512
c1f31dd33e53f72a1f61d3c702cdf08a0e89411b718c1dc4d643924e07cfb85382047adb2c778b81526d3941fd802e5b9fcfda73a34e27a8958e8b5949d9c49e

Download Submit