087f68c4c567c1a2d2f53af0bcfff87d2952d695753b8bdeb6f8cfafe5a63675

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

087f68c4c567c1a2d2f53af0bcfff87d2952d695753b8bdeb6f8cfafe5a63675N.pdf
Size

59KB
MD5

bd4317d18f8cdbca1e5db820a2185820
SHA1

78edfc6f1c08ffcb7137505a471c0ea0b3b56b0f
SHA256

087f68c4c567c1a2d2f53af0bcfff87d2952d695753b8bdeb6f8cfafe5a63675
SHA512

4f10dd5877ca4c8c2df84c55ad4f7feae1f978db82ac5523c7d4ed7c156c9a2b69b915bd4226b284072328819f1e478245136c593b9df5bdc92cada58feba7d4
SSDEEP

768:fuzdNIggou41dMV+foYlP13v+Bhn4+cITn+XHFsK1h/D:GzIW1dMV+foY5ah4Y4H+KH/D

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2416	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2416	AcroRd32.exe
2416	AcroRd32.exe
2416	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\087f68c4c567c1a2d2f53af0bcfff87d2952d695753b8bdeb6f8cfafe5a63675N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6fd9b09e8093fc6179dbb5260f45a511

SHA1
f27948d6998c7d0727d65413e706804838b569de

SHA256
1ca40f103dc4b2869d8c292950bc0f3c68c2994d8825bfb3d228843b1e323e0f

SHA512
4ec34d7189d3473fb1de37e6a58ab75d3a0e7ec8185b6c50e819875c4d935f822581d0ddf71be605da24f6bf36a689530a395474a93b1c3c605959339798008b

Download Submit