4441c3ce3f2a26067a2732977d4e32e995a4435f170f877825573d6550e9f79d

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4441c3ce3f2a26067a2732977d4e32e995a4435f170f877825573d6550e9f79dN.pdf
Size

54KB
MD5

7ba3c48db782f055d2a0bfd7b3867660
SHA1

93920f777dc2a42411100e0b0ce345989ec832ce
SHA256

4441c3ce3f2a26067a2732977d4e32e995a4435f170f877825573d6550e9f79d
SHA512

b3477c36754bf15421cd5a7e5132683784a1b6708444ac290edee31514ecde1ce3223b9689d5af667ee936042736ac42fd00dcc14406bdbd957f6414da8f2314
SSDEEP

768:7uzdNIggou41dMV+foYlP13ovZQJ9eyFqiJO6qolzmlx6SP5E7r:azIW1dMV+foY5CZQJLFqp6qolz8wSxEf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2064	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2064	AcroRd32.exe
2064	AcroRd32.exe
2064	AcroRd32.exe
2064	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4441c3ce3f2a26067a2732977d4e32e995a4435f170f877825573d6550e9f79dN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e323f426fdd37919dfb79d1c5be93cb1

SHA1
59652880a573949435f4a6051e990c9af31372fb

SHA256
db5ea21e0f43bcc457c1b133ce4821eccd727d660933d46b86ca367e7db570f3

SHA512
906c9d50d65f07df7a0ced4deb3a9c13eb887aed25729babd5f17da537fec3d0bfe2cb4abe4360cf4c5024a718fa11ce2213399872ca8eba3516b6daf3e8ad10

Download Submit