2e47ffa9fd45d28b95ad5c332c265e63069fbddbd1687f31a07210f79e1ffbf9

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e47ffa9fd45d28b95ad5c332c265e63069fbddbd1687f31a07210f79e1ffbf9N.pdf
Size

40KB
MD5

ac3a9861852870e5860f221def0e93b0
SHA1

86930082b341f3d5476415c2ba50879a25fbcdb1
SHA256

2e47ffa9fd45d28b95ad5c332c265e63069fbddbd1687f31a07210f79e1ffbf9
SHA512

e98a55efe6668c26cc3b48951f8b2279fd73ddaefd122264df3fadfd69b6ecb4862b8748cc73ef38e236fe0f03b799bbf8c4b29029206809b48b2a157b67918f
SSDEEP

768:M61QjxpXUiyVweykU4WizOrmYpT5cDAlujqPQUDYneoINJkAGo4/QnjqV2g6yDfc:ySze3kjq4ToeL/QJg6cMT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2404	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2404	AcroRd32.exe
2404	AcroRd32.exe
2404	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2e47ffa9fd45d28b95ad5c332c265e63069fbddbd1687f31a07210f79e1ffbf9N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6792f82ac9ddd89310529beb104bb4f8

SHA1
f0ce6f22deaa1aa674ec2c10861ff209bed35287

SHA256
98b18621a588aa2d67e1cff4d4cfb6cc30a7db3fdcbdc7172842095e0f893952

SHA512
c6ff2159452f490646d909c65bbbb4aeca0c334e00530ec400370faa61bd28c45f9f37c972dd306dd27f2e3e3b53c2672a86cd5141d86982347884fecbba2b05

Download Submit