bb428eca8da3a458657607881acf2e8bd489ca10f241b28ec3cc87d20bbe8ad9

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb428eca8da3a458657607881acf2e8bd489ca10f241b28ec3cc87d20bbe8ad9N.pdf
Size

74KB
MD5

fbebd2e8036437bb1b5929f138202340
SHA1

01c65cd53f852f5237decefa3bc6b3bac53b11c7
SHA256

bb428eca8da3a458657607881acf2e8bd489ca10f241b28ec3cc87d20bbe8ad9
SHA512

723ba7ab675c4c0af70f8fa99a352a3b13d6116bb09b9f185eb767a2769dd4164a37d9c9ae12f588cb2200bada50015d5893c67dc6c28badae59732fc6aff3a1
SSDEEP

1536:tdqGVLo8t4ROtfLm9TnOXCgDF2222Wlfzi1NvvbRc:tdqGVktAtyOyuslfsbW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3012	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3012	AcroRd32.exe
3012	AcroRd32.exe
3012	AcroRd32.exe
3012	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bb428eca8da3a458657607881acf2e8bd489ca10f241b28ec3cc87d20bbe8ad9N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3b557cc247c4f236b874633bcf705ad2

SHA1
fa2a649338059b3dceb08991dec5615e4667482f

SHA256
d95d1c4c9ea9f0ec275ca90c4801fbf19a2711dc0f8d9cb343c75582cfb354f6

SHA512
f82d3b608ea6678517805bba3d873d7ca02510d35d5bf80c3d569e589b5b2dc40ad61643212d800a54ed93f475cc8cbae800fc15e80159a213cb3392f4aff813

Download Submit