0920510eb053fa7ad192900ee2d033b334939a9f1c005b1ec7a12a6d9a80fb32

Analysis

max time kernel
94s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0920510eb053fa7ad192900ee2d033b334939a9f1c005b1ec7a12a6d9a80fb32N.pdf
Size

72KB
MD5

8b674bc777729f20f6e56300ba9a7be0
SHA1

7c2eb8f792ba3c1f8048b562a7fce691254cceeb
SHA256

0920510eb053fa7ad192900ee2d033b334939a9f1c005b1ec7a12a6d9a80fb32
SHA512

9b82c55a1a7af55e54db82c84d9f8ee7f3645d5583ceafcae05957b4518dc552e9e6b752ee809b147b5252ac92d995c5a0d6e76fd1871a04f6462b00e5ea641f
SSDEEP

1536:wdqGVLo8t4ROtfLm9TnOXCgDF2222WQSqB4bE2:wdqGVktAtyOyusQSc4bH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2208	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2208	AcroRd32.exe
2208	AcroRd32.exe
2208	AcroRd32.exe
2208	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0920510eb053fa7ad192900ee2d033b334939a9f1c005b1ec7a12a6d9a80fb32N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
41fdc6955d5a3b966c72a0156c4c1610

SHA1
c14ac4fe9e01d5d83c8fbc9265b897a2f9afa98d

SHA256
6bac9d5a2ea3271af1accf0e109ba8de40cc81622fe0c810a4b60f96e34ef4a9

SHA512
b5cab57be1b60ac3228b6fe725d775cabf98ec741131e77f7b4747a3d4018d03f26a1dccdea469700b0ed93c1848ea7a47f488f395e65f198c1aa19ef233b8c7

Download Submit