d5c401a6c975ddb4c9f930f9f1c59f02da2795e7618a3316d64973a7de5bf587

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5c401a6c975ddb4c9f930f9f1c59f02da2795e7618a3316d64973a7de5bf587N.pdf
Size

377KB
MD5

8a66e62e02f81bfa3c332afe7d42bde0
SHA1

e82cc6676745aeec73ce11913d0313a8fd01e426
SHA256

d5c401a6c975ddb4c9f930f9f1c59f02da2795e7618a3316d64973a7de5bf587
SHA512

b419087fb744ae7c91e260bcc98488280e11a4623bc1ff43bae128925b9a535ba9e3a38e4a40f8b86c4d3bd7f7dbf3d188e345fb01df72d3535090ced4328222
SSDEEP

6144:tYi7+oC2Iaw29NDpmEKUmmobI7n5a5yqM2hE4ES6Y8t2XniELRX2V6GqRneD2fKj:tY9zLawkgEjmmCma5yqM2hX8dt2XnzVK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1508	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d5c401a6c975ddb4c9f930f9f1c59f02da2795e7618a3316d64973a7de5bf587N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
76c035181d3350636caa3c86b152c44c

SHA1
731eefdc2bc311ac146aed250c3f50249c85eb7a

SHA256
43c224f5afbc2d2c6f527e1e8b4fb9ddc93f1191eef8ca95f2549660a6d3b188

SHA512
b452ccab7898ab1d60d655006527f4a6d2631fb168329cc1f67b7fe28bbb2f945ed49d820ea76854bb3531395dfdc3d868a44bb68cd1908cf1dc3b40a41b9a20

Download Submit