55ba800f814f4261fe210ba5a2321bdd0625e37cbd46c1313efce382dacabe30

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55ba800f814f4261fe210ba5a2321bdd0625e37cbd46c1313efce382dacabe30N.pdf
Size

388KB
MD5

1533462452657f5ed4e72b13a71130a0
SHA1

8388d1779554c4f1c70621ece28c401498bd11e0
SHA256

55ba800f814f4261fe210ba5a2321bdd0625e37cbd46c1313efce382dacabe30
SHA512

6744e103cb64f9bd1cf91ce0768c9c845ddd128eaf6953246acaaaf2f89ef196f2eed10ce46df8034118766e690b73ae0a1dff2082c1517b11de658423324f61
SSDEEP

12288:4x3q+Hx6jIs1r+JP9LJTkZoGGFjM6luZukC9:JWTk6EZDu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2816	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2816	AcroRd32.exe
2816	AcroRd32.exe
2816	AcroRd32.exe
2816	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\55ba800f814f4261fe210ba5a2321bdd0625e37cbd46c1313efce382dacabe30N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
39ba0d13b37cc51947a6df626b22f88f

SHA1
0e32bb30ca3f1f5cfad51213dec0abcefcd38aa8

SHA256
7d973ce5cabf75e269ec031e0569546ec32c292bb7dc5379d023c4fe2db6e9b5

SHA512
95bd026281ba39cd55d59264eb3b0609e83acea06a30585f4e7854756a4c23cafb4ec133ebbacb298aa7da1c161bc3f2ea9725f456a83f778dd5f0f194ad8741

Download Submit