7da62edfde1c8530ab8ff225b656e3e05cc142c3cff3eb4c99c457ad25dfa9b4

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7da62edfde1c8530ab8ff225b656e3e05cc142c3cff3eb4c99c457ad25dfa9b4N.pdf
Size

471KB
MD5

6d1e89314d039db0c369ce4f2a03d170
SHA1

e72f84c737879bee145a58cd9ada0d8536934679
SHA256

7da62edfde1c8530ab8ff225b656e3e05cc142c3cff3eb4c99c457ad25dfa9b4
SHA512

3094bee0de0313afa7fc74fccb4156a5c1382a3cc9e0e468843c8cd3f2b1dc6acdd960b7a24344538c2075a05c89a5995b6efd912fffca75438a7dcfa3ac49e4
SSDEEP

12288:dTKDt8B/SOKobM+FpQQVYPh/LoH3sxu97B1+7VILVHcj8:deZ2g+bhVYZ8H3sMPRW8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2524	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2524	AcroRd32.exe
2524	AcroRd32.exe
2524	AcroRd32.exe
2524	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7da62edfde1c8530ab8ff225b656e3e05cc142c3cff3eb4c99c457ad25dfa9b4N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
787064366d426ba7aaed92c86a0bab03

SHA1
bcadb03ae08c6e1c613c9783367ad2e70d696df6

SHA256
de2471647a5c561d0a7dce032799f3807cf1f42e19c90ca27cfa42439ee9a212

SHA512
a905d91b1fc31f01bcbd4ad2af9afd914ac8487ce1a5d2532964f4d3a89a225ce1dccc9e1abc31019e8fa029ea26a5c29099970a97bfce4ef1c2dffecbda3ef3

Download Submit