a984ec1e484a48cf9722dcc0bb809f44f6efe5ae5b4586e42599639a4a9704c9

Analysis

max time kernel
90s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 04:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a984ec1e484a48cf9722dcc0bb809f44f6efe5ae5b4586e42599639a4a9704c9N.pdf
Size

201KB
MD5

36cc4d3cd082fec6116767595dff9b30
SHA1

5d08187b04894e20381cc2ab01d61a43eb9b8627
SHA256

a984ec1e484a48cf9722dcc0bb809f44f6efe5ae5b4586e42599639a4a9704c9
SHA512

d6009e4c504548794775d9da76950dc605b006b58c31e7e12e1b34be05aab57c55d97e8c400b835b8008e54eb3e0cf55beb2badbf7ffccf1739e68db592eb921
SSDEEP

6144:Dhgsuq4hkIR6vtqvyTIhJdf9jdxHSr+ncF:+Rqmg67jpSr2cF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1364	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1364	AcroRd32.exe
1364	AcroRd32.exe
1364	AcroRd32.exe
1364	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a984ec1e484a48cf9722dcc0bb809f44f6efe5ae5b4586e42599639a4a9704c9N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5493818a4adc4f4c023cfb7b0edd35c9

SHA1
4ad5723ab836c3462be3aa69c567b62f37326d9f

SHA256
0569aca6c3017dc19ea0db21d3a1ff5b57ba816eb82e89ae5ada64d7068e10c5

SHA512
830d5cf3f900a69d143ef6e6e72e93e54d49d45e37f0dcc439e8a1a412e23fc0e9927ba0f528f66f72e8dd289bc1b1ca29768fe96cab5ce472f12d6f82a88793

Download Submit