2b9054d98bf6dd5a101265fa6b39f95fccdc849181e9843d61d2ce0395261059

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2b9054d98bf6dd5a101265fa6b39f95fccdc849181e9843d61d2ce0395261059N.pdf
Size

765KB
MD5

5ffb31e5e0a047e8354926f165eee360
SHA1

a561e12a1f33ec99b0c56066237c9cefa639ae01
SHA256

2b9054d98bf6dd5a101265fa6b39f95fccdc849181e9843d61d2ce0395261059
SHA512

a8382b81f3fb92ae928896609ac3e0631f7afb224f320ae70d19952b63ac99183fc971aa9bc347d3bfa637e18d2be0a6fe43238dd8282a8635aaa4b852e18e33
SSDEEP

12288:u5Lono+Ei3HloVVFbbJ5od2JHJ5IrhE+j1+9RsYk3/qXMatDv0A4Tgjq33L2h0vZ:u9P5QlobFnjod2Bb+j12sYnjtDb4TgeP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2008	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2008	AcroRd32.exe
2008	AcroRd32.exe
2008	AcroRd32.exe
2008	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2b9054d98bf6dd5a101265fa6b39f95fccdc849181e9843d61d2ce0395261059N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1058597bb0279ba8a6e0d26b3f2a0836

SHA1
e460e08d6995efb126738620ef95d936bfb3b7f6

SHA256
9aaa9fdc22aaa104c25db791eba2d4c2931b00f3461c00321c2a12c0bf76375c

SHA512
acd7d011c41339e6a3f987459369c20475e6565e03bcc3c4645db06f02d6ea29248f43fe75a8e8f2b01198663ccd80ca5a78ddad5912e115c7bc63b2e26d56b2

Download Submit