4bb83b488b7e8f2f5b1953812b830ea39a4c2b09509e2d8fbd58bece25950ad4

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bb83b488b7e8f2f5b1953812b830ea39a4c2b09509e2d8fbd58bece25950ad4N.pdf
Size

104KB
MD5

647d0958b8c50c7cc10cf08ce7d9b0c0
SHA1

e28ab0d0c8a495312583fd89c93f8fac03e271cc
SHA256

4bb83b488b7e8f2f5b1953812b830ea39a4c2b09509e2d8fbd58bece25950ad4
SHA512

f511bd07de16723540e4c5bf290ef4f433e56324eea7f4d283a6e1cdea38d4d1313c0bb38d107a41c2d2bdc34258599b0bdd45eb03cae16e4233980386ee89ab
SSDEEP

1536:z4j/WAZVFyNprfzN9b/Yf1DYnYJKrdM06DzJeFiWcoGvVYEzDZJrTZO:bE4rfzNY9dJKrk/0YhvVHHXs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1980	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4bb83b488b7e8f2f5b1953812b830ea39a4c2b09509e2d8fbd58bece25950ad4N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
33b62aaf97fa8db94d0503b064b95f3f

SHA1
8641898dbf0788a2b796025bf06056ae069a122e

SHA256
eb561b492993afeb96fdc633dcf6e6798b50d09d40c6c372eb9b6f7ffd90a3b1

SHA512
86253cbd08c1cc195383cd9fe9d53e021ecd721e8fb6eae3ee6e2222421604cac67f022fd6643a937da5f734f447f31c952220045c201ee83a31ccf00a4fedb1

Download Submit