f46a1a5ff08e12475fe8ac5c31300035e267bf4fe6b0c8e07ca6034af7a3a9ee

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

279700204396R0.pdf
Size

250KB
MD5

4c001f9dfd483d5c7e11762031276291
SHA1

fd110540a9ac510ce46d14af65005399c12d1bfc
SHA256

f46a1a5ff08e12475fe8ac5c31300035e267bf4fe6b0c8e07ca6034af7a3a9ee
SHA512

307f03a40c82e9061fee99d7fbd1173504ae384f62163712e1795c5a029446afa8bd658abf499fecb66ace15d1b989842a7dbfba6c2f7530eeaaaae9ae72f9e7
SSDEEP

6144:MGdq44XF3arm9YNzy6q3dHw1uNswks3axG:K449ra06Avks3axG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2104	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2104	AcroRd32.exe
2104	AcroRd32.exe
2104	AcroRd32.exe
2104	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\279700204396R0.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c6ef9632ec65000564b0434bcc412c6c

SHA1
7e0723fae88857f522d7f662da7be74201f33d5f

SHA256
7b4463e2db7fb98f3579ce4ee9b68ab6d28cf52f85920b91d577dd66b13cc8c7

SHA512
c4854312cc0bbb176de068b715bdd1d73552915cf7d37e71e15bacaf95304dbbc655f4fd95185d5be08edcb7c9bb93ccc0c6073d9b3b2ada63ad8a5f1b47f2b3

Download Submit