dcd54f269487d3abc218b03fd98e3f10c2ef5fa8ea89f5462ea60f1f4d028e96

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcd54f269487d3abc218b03fd98e3f10c2ef5fa8ea89f5462ea60f1f4d028e96N.pdf
Size

1.7MB
MD5

50c30ef3a10329f4e2da4b01bbba3fc0
SHA1

6052cccc17b83856801234c437edd3ca6ae8c1c7
SHA256

dcd54f269487d3abc218b03fd98e3f10c2ef5fa8ea89f5462ea60f1f4d028e96
SHA512

954a7ae7f77be90d3316c0e0b3c75fe5026148b706495d86424f5b3bdf0f58df8532c2320008d6343288e508b392f737d46576880b7a30e2322a4ff6ad8a03fe
SSDEEP

49152:Ujp/d0U7MKq4gqVk5wu4BqVubZLK4hqbiR42qc:a5zq355F635KObNT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2104	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2104	AcroRd32.exe
2104	AcroRd32.exe
2104	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dcd54f269487d3abc218b03fd98e3f10c2ef5fa8ea89f5462ea60f1f4d028e96N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f599a46048e533b320fff119aff3a8ff

SHA1
4a3589edf72877bc84d7b299194d6d8698e936ca

SHA256
39d818129f9e6928860479fa3cbf74b296c742d1f594e539d8c58415976a1d63

SHA512
19057aed8a4d2947efb66d83286b011a47aabce9809d5853aa23113134cc2a6fcd50c2fc100fe21769b87d1c77015504e200e7583fbd60a921d9ac7b80b3dac1

Download Submit