7f8d33857a9cd77c624c1b72265554dacd0a349e66f0bb8adfa1b7631285ea53

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f8d33857a9cd77c624c1b72265554dacd0a349e66f0bb8adfa1b7631285ea53N.pdf
Size

364KB
MD5

bcc9b24beb78fd6e392c88acdbb296d0
SHA1

15b95472e54b9d9d63e66726c058d9e4509029af
SHA256

7f8d33857a9cd77c624c1b72265554dacd0a349e66f0bb8adfa1b7631285ea53
SHA512

bd9340b2f21a3ec40dca89055e604ca1e8e60aadfe852771db6d28fca62a353421981ef114e3faed15fd2b39aa93a413b778ec96fe830ebbdcb89dbe135ece32
SSDEEP

6144:58eCqqIVIgZ45/QE8DL/dw8UnULv+Bxme6fOeGVYCFDcCWj48EuoeQ1ozvO/GB49:IqqIVI4+/Q1bBe8v+BxmrOeYX164EA1D

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2184	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2184	AcroRd32.exe
2184	AcroRd32.exe
2184	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7f8d33857a9cd77c624c1b72265554dacd0a349e66f0bb8adfa1b7631285ea53N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
63c6582b7cd868608e273807159f2e23

SHA1
98ed8ab4519614d452458d4e62fcdce1575a99bf

SHA256
6f9cfa00353f86a910a1927eb9ddb9641b7146ad5808aed83ea26f56bc2bdb8b

SHA512
2735d1812dc27f7b326709ee6e189e1818f2fc8c6e6adee21bcf82c981b1e00698ad9c8d20fa0b1f4f801598cc67eecc4040635ce7fb13651c16bd614851723c

Download Submit