09247527191974df50e4d1e12712bb5a5ad975238ec6519bbe240c24a7878639

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09247527191974df50e4d1e12712bb5a5ad975238ec6519bbe240c24a7878639N.pdf
Size

300KB
MD5

0d9e06d9d0c37742a370e3782e3e52d0
SHA1

34a5dd332614ba2b91ae23bb80b0e7d27caff2f1
SHA256

09247527191974df50e4d1e12712bb5a5ad975238ec6519bbe240c24a7878639
SHA512

e5ef74b83e5d2830c6e39386879bd55cf06b581e17122b0a4585db801c4351533a833d7c2424d4b2bdd5d0109b28e4280a6285aa188c50f1b10392cfb138f7d6
SSDEEP

3072:cH0jIkUqVb3M3TNw95DCemoCaOGTqp4PzRTY1TiU3o3DNIg3N+JuWr2CM:cHKUqR3M35IJd5G+bRiOUEt3N+JDqCM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2960	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2960	AcroRd32.exe
2960	AcroRd32.exe
2960	AcroRd32.exe
2960	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\09247527191974df50e4d1e12712bb5a5ad975238ec6519bbe240c24a7878639N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2bff51e51a3afce30fcd30c18011b11f

SHA1
ffb0e2512cd7429c1644c8220a1c8eeea89362e4

SHA256
d9432f7eae006bbdbe58329e43777a76dec7d3839d9b0b2a458088dcc2af3179

SHA512
8abd93e10fc156b04c6c88297fc69cb32086f564a996797076d203ecc193ce7eb2b03743b8495aae2c820897858960369edf756a9517ef3e04ee0598432122f8

Download Submit