d17229f23327cabe0c95c13333c6c567b949e96296faaa4c6145f3f8253c10a7

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d17229f23327cabe0c95c13333c6c567b949e96296faaa4c6145f3f8253c10a7N.pdf
Size

54KB
MD5

90f487bad33991fefaf81d36fe5066e0
SHA1

1dc4f9838a14a38bfbb4eea172be774e9e4421b6
SHA256

d17229f23327cabe0c95c13333c6c567b949e96296faaa4c6145f3f8253c10a7
SHA512

93fbad372ba1a23483aa4f35a154ec9ca58b3446e7a843db47c051dbeb048fcad4354b6b7bfd3d873db0d7128d3f72dc0776a63f5eb11cdaee0ea6970da62494
SSDEEP

768:0uzdNIggou41dMV+foYlP13I2LqbijeQDvDBxPzJ2XgHmr/5heFfii/:3zIW1dMV+foY5BjeQTDN5Gr/nwqi/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2628	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2628	AcroRd32.exe
2628	AcroRd32.exe
2628	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d17229f23327cabe0c95c13333c6c567b949e96296faaa4c6145f3f8253c10a7N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b6ea9ae4e62eaaf45068511c78f33c34

SHA1
f5a48fb4ed6e6509060b7f75acefcfd744261832

SHA256
7a441d6581d4acde3a10aa0c701d030e42454427cab96a5e4684b4a7cbcbefe7

SHA512
a93f26427af6b6401102686ef1db13cabd424e2adf093e493328da419310ecfcf420517d5a847326f7662dffc8f4933cde42dfa0bf10cee6e9db25c7116bf9e7

Download Submit