734d518a2e9dcaf8d488cfb101fe799c039a0031523e36d5238dfe66e620a5cf

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 18:21 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

734d518a2e9dcaf8d488cfb101fe799c039a0031523e36d5238dfe66e620a5cfN.pdf
Size

73KB
MD5

26d0fe71a27887216fd691f2450cca30
SHA1

d3bd2aa69f842045a755a940ee44ba204bd97bdc
SHA256

734d518a2e9dcaf8d488cfb101fe799c039a0031523e36d5238dfe66e620a5cf
SHA512

cd605febe30cfd855584ac5ef8ef5d3c7440d086e6e6cd6e990fcce030df593ccd53682caaa2e9324c82fa8c0db3fcf7b2dba8342937e8280a7d28def6a7c356
SSDEEP

1536:p2eEgRdUzqR2QlZZ2TQVol1bY37dWSqWVPdhojWYpOel5rwy6:5EslRDkQC037tD1dhoqe+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1520	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1520	AcroRd32.exe
1520	AcroRd32.exe
1520	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\734d518a2e9dcaf8d488cfb101fe799c039a0031523e36d5238dfe66e620a5cfN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
35051ccd3c9db13ac6398182cf6ad5ba

SHA1
bb602dc1a7db803fe29678623abcbb8c1787a684

SHA256
61c60bbc29f3437a63db94b14520beaa5f5aeec951da2cbd61aeb2423cd1f141

SHA512
ab52be06d12651ccef2310e2ef8dd9affea8b7af0f11440bed6beef3b134927d33525fdf5dedca129747c92c667882c318b33752b9c5e03004c940149cca7fe7

Download Submit