861d2dc7ee4244c911de4bf7c10f51c6d9068e3476fa5e1a1f5c59867b69ed13

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

861d2dc7ee4244c911de4bf7c10f51c6d9068e3476fa5e1a1f5c59867b69ed13N.pdf
Size

323KB
MD5

a7e4f18d7dfc54806ac3939eaece09b0
SHA1

8fa94e94302c5bf7af6be428883c045db558ebc1
SHA256

861d2dc7ee4244c911de4bf7c10f51c6d9068e3476fa5e1a1f5c59867b69ed13
SHA512

89926a2db8b28a93b2e14c8b7a8e311a80867f4615c23f7819d05aee09e9779429a44b0a56d064a517f5a294278fed52c77fc5bc2cc5d4840316c35ca52aac23
SSDEEP

6144:pS+JTWaTwLSvucfJdeUvBJnOT0H/eqjDrkAqL6hydJLuivB2BEdFntyN4Fk:pZCa8YucfzeIa0H/eqDrXS6hydJaKlNi

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2932	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2932	AcroRd32.exe
2932	AcroRd32.exe
2932	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\861d2dc7ee4244c911de4bf7c10f51c6d9068e3476fa5e1a1f5c59867b69ed13N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
de10ef5062c4aaf3841de22c2f1312a1

SHA1
ac6adb473bf963d62df070d887d4e3125883cb2e

SHA256
dec8ab26ca09f5e478a78db04e5e816a0b31cdd8125e81392e9e4e55bb80a925

SHA512
9eaaff190768dcade16f30c2205330fb73835f4815fc1b1c41d3a0b3a11d607b9434a56c8da17a4ff65c87d52d22b103a6bb290919fe2906e39fdc956eac56f5

Download Submit