5c2bbac496f6c8c1f03b7dfd88d4237c34889b7b3f4141095b1ec5921686a779

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c2bbac496f6c8c1f03b7dfd88d4237c34889b7b3f4141095b1ec5921686a779N.pdf
Size

76KB
MD5

8f2b689e3965f60fd66876770b0d9a70
SHA1

ad962d26eebe2812abded9d2675176a478eef9d3
SHA256

5c2bbac496f6c8c1f03b7dfd88d4237c34889b7b3f4141095b1ec5921686a779
SHA512

9063b39bcfac65feebc18e18ce7bd449e39fc2455ac757af09b7f8a4cc1c5ae4e80ff822a24666efc7f0616384d1234857153fde13b9326cdcc51e0a94f7916c
SSDEEP

1536:+R6nGD3K31+8A7Xf7cjQZyQOygDapn0D0UK1myWZFFFFFJGvlRTLBUI3nOmXwq3v:zEKF+8A7EZJBcn0DzweFFFFFJKTd7fBt

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1672	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1672	AcroRd32.exe
1672	AcroRd32.exe
1672	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5c2bbac496f6c8c1f03b7dfd88d4237c34889b7b3f4141095b1ec5921686a779N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
418685bf697e36695d47d3ed968346d9

SHA1
855d5fcb3172be54c46f81592b395e61a848672b

SHA256
26a2380bc8b455525e097cb199b102bd80102c66a8dcb1f15b4fc22ebb4c0f79

SHA512
f6c55c4caade81746d6b17c1123d11568c95ac475e2025862644f5c3e961bc4f111c45239441885466f511cec10f217396884d66156173cc81763de590203264

Download Submit