e229b6ff0441a27ac3f2158989b3df84a954ef0deef06843b1b1f7c32fe6f145

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e229b6ff0441a27ac3f2158989b3df84a954ef0deef06843b1b1f7c32fe6f145N.pdf
Size

487KB
MD5

e5923ea985ae4c4d644d05f0eda83a40
SHA1

086ef310b55d84ac9baa34a740d259a36f015f76
SHA256

e229b6ff0441a27ac3f2158989b3df84a954ef0deef06843b1b1f7c32fe6f145
SHA512

9909e76c1bc62fc6186676d89fdfccbf809e098d529c9ef8a1b6205245f5094f098d1e89459a0abcc3ce0108c9af81e7b04cbe4514d626ddc6e9021ca8c297f2
SSDEEP

12288:ZwWuB2asMqR+63EZQ6LvY5cbbiXkrCFqTFPWUpY8lfiTi3cKV:uca36UPbWcb+UroGPrK+aQcC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2052	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2052	AcroRd32.exe
2052	AcroRd32.exe
2052	AcroRd32.exe
2052	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e229b6ff0441a27ac3f2158989b3df84a954ef0deef06843b1b1f7c32fe6f145N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e7612fd45f624620a87dcd2f06bc1544

SHA1
ac643cbc33f08d756963ab214d4fee64bd285a07

SHA256
1ed6842f1d8588c6410f5b3572ddf17a9a03e25974c33e446da3db3fe7c5381e

SHA512
7a8667224db41dc97542580150b3e1968e0986b98f8cc1d8c13a62100c963142ca0c8fa125b3a8eef3bd5dd016f6f16fea2e7ea347b94a253e31a63d0475b979

Download Submit