27e8f595dd8de51a8410e014f847893710bdc6e9bba41473f5c9dc5e54bf307d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27e8f595dd8de51a8410e014f847893710bdc6e9bba41473f5c9dc5e54bf307dN.pdf
Size

443KB
MD5

ea4f0f5624e8c8c0dc37cfdeeedadf90
SHA1

5df7e0dbd9b4fae15c9f2e074758d4cdf9e6c6ff
SHA256

27e8f595dd8de51a8410e014f847893710bdc6e9bba41473f5c9dc5e54bf307d
SHA512

def3bdc7856c395a61bb7c49647f5a897992880e97bb4163a236920d14f4233b43bf6ea2396b40703691445cdf6bffff8d2a2e23ef6e229f7000d2ea61224334
SSDEEP

12288:3OffZP/sjvIF+kYw5Qe27ctZcUvUNNcWLVJWB:0fZP/s8F+kf5b2KYNcWLVUB

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3020	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3020	AcroRd32.exe
3020	AcroRd32.exe
3020	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\27e8f595dd8de51a8410e014f847893710bdc6e9bba41473f5c9dc5e54bf307dN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1f776e40b6699d7a71cecc1142145275

SHA1
55bb2455803ad961fc16b3c61a9938499b01fe21

SHA256
b8ff297c5e156d5dc47eeb7ff0f92f2fe915be07e3ccaf8c748bd1422abf23b4

SHA512
de8848e51e535e77ccb764e81ad87252cf53b6fd6cc35540581a66efaf5e1b7866755b3a102f96e11b54ffa5ee8a4a66d9621db7c97b94a6c091a28302e8f274

Download Submit