6577220bd1eb85698b626aaecc93d3af8d3b3dc07978f22bd6b01ddc1b15e1e1

Analysis

max time kernel
92s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6577220bd1eb85698b626aaecc93d3af8d3b3dc07978f22bd6b01ddc1b15e1e1N.pdf
Size

368KB
MD5

f7baf206bb37e4d30bac0dd8bc783920
SHA1

ba9165fce32d35147ddc122f8e1dd20adbe823ab
SHA256

6577220bd1eb85698b626aaecc93d3af8d3b3dc07978f22bd6b01ddc1b15e1e1
SHA512

991fe9ee0dacbf53772bc6eee09d9369d9cd63b8a8fc2b61983dbb1d55f3f35a1323c349d7ef0c15c9ab1e9ae7e51d3b3ce5316e1e4527aaaf6b5731ec050218
SSDEEP

6144:DHHP2MSSIsdH0BI5jTXNOCqKjsc8iR80S1yUFbtQRF4woa3SDjyMfq/Zm7DpC105:b2DsdHhXOs/8iRdSFrfnj0mfpIjWfJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2176	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2176	AcroRd32.exe
2176	AcroRd32.exe
2176	AcroRd32.exe
2176	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6577220bd1eb85698b626aaecc93d3af8d3b3dc07978f22bd6b01ddc1b15e1e1N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
38f29e4cb1efdafd5a1b60dd5e527b07

SHA1
ca9e413ca538644c81e2029860c4fe392a0c7417

SHA256
3fda8ddcf46760e12f26d41517e8c2f68fd52f93956ba568061d9f71e1559004

SHA512
74d0ab5ff14a7fb251b51484aaef5f9bce9d4a523c158cf09aeef4e16a71d095d5816b66d79fbaee47deb205a577c4c2a16d8cacfb0d2e577738cb07843c7b40

Download Submit