e8758c23d629fd3cd6060c67079615eee5943d07a73af679e5c6830b204fc42e

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e8758c23d629fd3cd6060c67079615eee5943d07a73af679e5c6830b204fc42eN.pdf
Size

56KB
MD5

7117bc35afdc413eb9b81a99663e9130
SHA1

b7f2e9c175a29fc01b3c947e2b9d97f3de736b13
SHA256

e8758c23d629fd3cd6060c67079615eee5943d07a73af679e5c6830b204fc42e
SHA512

32924e7e67f64cea6721d02df5964e02ad04f6c71d86dd8580d6a306c080edeb238adf851a9d147537f069278dee60911eeec9656dbb65bd5d1fe5c5efa578fa
SSDEEP

1536:VzIW1dMV+foY5Zz1Hsw1z3DbEneFcliDjg1x:yWHMk3z1HsY3XTLg1x

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2692	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2692	AcroRd32.exe
2692	AcroRd32.exe
2692	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e8758c23d629fd3cd6060c67079615eee5943d07a73af679e5c6830b204fc42eN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0e7b97dd92106ec9dcf75cecee4da64f

SHA1
e870c02f290cca5e04ce45e4798e6d5014abcc1a

SHA256
ab72295dbb94e506c33a79d3eb56b24977e8b64af816f8b036c8acb66ef3cc63

SHA512
89b2186a94a9724bf0288c53b81f859a867028d5f8fb32e95f4005d914c39858c12c1eb6a169dc0972c3bf6764d66fa9db71dc1b87ac4cccc9d66a85419e370f

Download Submit