29f86dc2a5427ff359f19209887ec6fc1200ad873dde630e2097b7de71bc3847

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 04:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29f86dc2a5427ff359f19209887ec6fc1200ad873dde630e2097b7de71bc3847N.pdf
Size

572KB
MD5

75f2691879c75c917ffaff041dcb8a50
SHA1

c961c323f7587e5e0d9764241dd19f68267fea9f
SHA256

29f86dc2a5427ff359f19209887ec6fc1200ad873dde630e2097b7de71bc3847
SHA512

cafb145750275b4f9c53f9b9c497385e578c33caf83bbca1224f65c642cb6b3b2c9a9a18ea8dda67df7e764b6b81a121143f094d7067a65352498e41f0ed0e4a
SSDEEP

12288:ove8ImLbNaL5JUtEs+6N6c/4b+aRpu46atzEJY9oSbD2ynEzzSylrK9KrKR+:ove1qbNa8ta6Ec4yf4jXEzzSArKpE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2688	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2688	AcroRd32.exe
2688	AcroRd32.exe
2688	AcroRd32.exe
2688	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\29f86dc2a5427ff359f19209887ec6fc1200ad873dde630e2097b7de71bc3847N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f0938add78c4f892990e381ab01230e2

SHA1
7c2aa75f2d266fc29e073668d7415e82695f0e96

SHA256
6e144fb7127499707604e9585ac6e0a6258283fcd16bd6bef5688e09ae60b36c

SHA512
688d9a0e7dfde04a3875685b4257dfca0244121b508ca882a40e272a4f460949383bd7aaff76e54cfb2a45297e391308b37d49af87760e35d78e216333a8e141

Download Submit