bcf9ae137221f418ee96a6849ce625d85549ccacac605396cc5eedef3bb9f0fd

Analysis

max time kernel
91s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcf9ae137221f418ee96a6849ce625d85549ccacac605396cc5eedef3bb9f0fdN.pdf
Size

335KB
MD5

9f4df77b1dc8cd900bf5dc7cbfc485e0
SHA1

50f5b36be77cd9c1bd8ee808a1a020d7cdb910f7
SHA256

bcf9ae137221f418ee96a6849ce625d85549ccacac605396cc5eedef3bb9f0fd
SHA512

d25fac6fde948006ef3cc2e1b67aca648069a8680475bb26382d8019252f575fddf139a07e6e65e61344e114e510b5d3ef0f080af95d82d22bf9c6ba078ccc57
SSDEEP

6144:ZMQYSPK2+z3j/+tzC/P6YpDluejeAonujDQ+pgaqBjzQdmnlAe2IORATPMPiDzx7:ZMQYWX+z3j/UC36iR7vQ+pgawj8dQ2Ir

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3048	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3048	AcroRd32.exe
3048	AcroRd32.exe
3048	AcroRd32.exe
3048	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bcf9ae137221f418ee96a6849ce625d85549ccacac605396cc5eedef3bb9f0fdN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a1116fc93de704c8a3278025ecdff0cb

SHA1
1ce4b3a902b28c72bdc6c3fb91bc75328a3bb953

SHA256
67cb41a83f29b4fc82ed59212871b76431cc1dd414f50dedd9b55cf6cd7fc705

SHA512
8cfc2562ff925c156cd1718f691bd22c344c52fa33823490e5a62ab79344c8955d5806176003b95b0f46cffb5a575615c5c799704fc2b602b0126bb9c66955bb

Download Submit