a72aa72c37ac5bba3eb83de8d099ede533582577dcdc25ddf20f2f2d11f8e2ee

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a72aa72c37ac5bba3eb83de8d099ede533582577dcdc25ddf20f2f2d11f8e2eeN.pdf
Size

842KB
MD5

1bb2287cbed4e0735a18448bde9d0640
SHA1

1f05bfc7bbcef1c40af5dd21bab04f41fe615467
SHA256

a72aa72c37ac5bba3eb83de8d099ede533582577dcdc25ddf20f2f2d11f8e2ee
SHA512

29e1a28f47c3e1ba7e7a296239fbeb93387ecc53558bebf90d5331b1801eacd01f050a047f0d1da3fa94ce9c1e2704c292a6d2a2a6c0b094f8859f5c0da6c697
SSDEEP

24576:wpDQU1nna8h/ipjvOSXGDmE8aOVOgoezYUb:w9QUFnGlXXGSEmOzeUUb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
236	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
236	AcroRd32.exe
236	AcroRd32.exe
236	AcroRd32.exe
236	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a72aa72c37ac5bba3eb83de8d099ede533582577dcdc25ddf20f2f2d11f8e2eeN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7eb26cba93c3cb19af4a2fffb6ea20a6

SHA1
1abfaf713af3041df6e7df0c96418aa284335b3e

SHA256
1e80815f740a7243e691aa3e3a37491b1b7de97604cbfdb56631a74b720d7515

SHA512
aa581d2807b19f261dcf2f5b1eaf60cecff59795f81f4a6dcdadeafac5088ffb506b747b3139faf9ae0f1a03a6be8c5a4b751683ea8678c522b86a8c75d9a913

Download Submit