9ee260b98e3b24a554e5195aeacd19b5accd787050830875e03eec12f5c44da4

Analysis

max time kernel
119s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9ee260b98e3b24a554e5195aeacd19b5accd787050830875e03eec12f5c44da4N.pdf
Size

97KB
MD5

f90ec83cb159a58eebe286b4e72b6530
SHA1

7d069bb191fecb602322ae8fbd940a11d19e2c3c
SHA256

9ee260b98e3b24a554e5195aeacd19b5accd787050830875e03eec12f5c44da4
SHA512

79a98460a0fb1de4021b407db3338aec7f9771cca0b68c9ffe3f5872a938271faf927180bbca85eafd6c85263717da035813fa4a4029a73f7545b09d9f433c39
SSDEEP

3072:sdQsWHBITiaIzPTXOOOOBnGb7awiHWTpYOsUVDh:sSTHi2aIj1GXPi1lQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
800	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
800	AcroRd32.exe
800	AcroRd32.exe
800	AcroRd32.exe
800	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\9ee260b98e3b24a554e5195aeacd19b5accd787050830875e03eec12f5c44da4N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c0db66fa531a998564c315112529f83d

SHA1
56c9c0589d69472dc8674c1ec4ee9ebd4b04e0fe

SHA256
bc336aed1964e02366f42a7087fe257129cdb4d2b3ef4459e83cce0fb00367c9

SHA512
02a91b02f81dd9f27396abd8624d8a558c3aaaa28597d31ce7f4d49114b48bc7f6c49aa0508edc84f49d9a00ae5570c7b10c6aebe8ee4611aa6df7bb4f7864fa

Download Submit