2c3e25e24da6ca5bc9268efddc14d85c741ee5e4d4e386ab265035c87bec2d7d

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c3e25e24da6ca5bc9268efddc14d85c741ee5e4d4e386ab265035c87bec2d7dN.pdf
Size

55KB
MD5

445db5cbe326f559bffac334b79f2a70
SHA1

4af36c29b93fcb828a378b69e14e5c852bef4bda
SHA256

2c3e25e24da6ca5bc9268efddc14d85c741ee5e4d4e386ab265035c87bec2d7d
SHA512

f67b0d1124eeb0bdb70d55175feb21b5470ab31e59193c03ebacf4ac8768f5d813318ca103756619f25cb2310839f646ae34cb8f5ec819451e803bbf1d5d016a
SSDEEP

768:nuzdNIggou41dMV+foYlP13hSI1k7yuuHFcWpre7rTvqBeWAdWu5Q4LbZ:uzIW1dMV+foY5aXpuHFVY/AAd35VLN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1344	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1344	AcroRd32.exe
1344	AcroRd32.exe
1344	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2c3e25e24da6ca5bc9268efddc14d85c741ee5e4d4e386ab265035c87bec2d7dN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4519f98d2ae67dd16aa0539e54adae94

SHA1
044dc37ce9d027aa435004cde5c0138efdf7f31b

SHA256
6e027681c1aa58d40059df728bb0ef9125e68f6dfb2add7187978371637c32c1

SHA512
af86eabb62c9839ec2c641d2cc225033f96a558ad82e0e63801b3e6ac3a14b4358397bb2024aea60fa2135a146813d54dc8189de83e728d5db62dd3fbae8a4c7

Download Submit