34a369b0a1bacc4511d9046a13ae4d30ea137d882ffdc3ac6aa3b0525ed8809f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34a369b0a1bacc4511d9046a13ae4d30ea137d882ffdc3ac6aa3b0525ed8809fN.pdf
Size

8.0MB
MD5

c0a5736842041e139172022f75651120
SHA1

f31f64dbabadfc9ed62f1e460c5e00075a5ac773
SHA256

34a369b0a1bacc4511d9046a13ae4d30ea137d882ffdc3ac6aa3b0525ed8809f
SHA512

8fee3728c06b0191b4b20044223ef367c2a0008dc007f42746932b8b35e8cf40acff2851f8c6bf46d1410b665c28fe43bbbcabb24d74a296c7d9f9c5896741d7
SSDEEP

49152:+97qd1ZAw4Zr4KIW6EEW3LXUg6RP7n2kABhTqQ/Dq7te6RhTCXzGu4bAJl9xMNrt:aqAing+t9TcSAJascf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2980	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2980	AcroRd32.exe
2980	AcroRd32.exe
2980	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\34a369b0a1bacc4511d9046a13ae4d30ea137d882ffdc3ac6aa3b0525ed8809fN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a1e7f6a6f69d140df82d7dfd1bbb0a57

SHA1
f764e4c6bafa97bdfa12c00834b0745a970b0814

SHA256
a9536a11ef5d70a40260bf5c4c4ae8f031dc573e44b6e501f914f6a644240fe9

SHA512
f2134b555f1df921388e70172504f4a40f761f0d165dff2b36155a3131269e56cdf86a7a9d755e6c2fc8bfc5f429924563aedc296ad87d48b364545fcda8ceeb

Download Submit