35a8e92d4d71585ddaa526b6f2a294b046b0843452315db535ad074e2758e539

Analysis

max time kernel
92s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35a8e92d4d71585ddaa526b6f2a294b046b0843452315db535ad074e2758e539.pdf
Size

472KB
MD5

72ddfff454b94de2c8f4da1ce6fddbd8
SHA1

6078d855032748c57dde333ab41d5937ccb56d76
SHA256

35a8e92d4d71585ddaa526b6f2a294b046b0843452315db535ad074e2758e539
SHA512

9be3ad730dcd07f0d65a720d665adbbc4266fa529f48e2a9519044be277bc2c03ac3125757f658f41d8a4432c62551cba4797066a38fd4c958083d9e347d84bc
SSDEEP

12288:YJW/Z1TQMdqyHukOk0f4XwzQyMZWO9JuGU25daZvGFZtw4P48z:Y4bndVH/OrJMZRSNod+gZ9Q8z

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1424	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1424	AcroRd32.exe
1424	AcroRd32.exe
1424	AcroRd32.exe
1424	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\35a8e92d4d71585ddaa526b6f2a294b046b0843452315db535ad074e2758e539.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
96073923f98596bc0b3566e584f96041

SHA1
1ba2d602cdc50145f347c98f32bdf0d39e4395cc

SHA256
4ebf894f347a30f412ea0ab734c8f79d732628c41d3c544bea069e3604b07326

SHA512
a5174b1a87316a9337967f0bfc8481a3c7bd52cd40e4941ce6f4cb3878330c52691d1585353312ea36407423ddb47cb31917c5b929b11a7ff443cbcaba407f4f

Download Submit