7c6af2cca4c96ba10b597616aae5578aa48ef039ceea578f56dcf77954c38eea

Analysis

max time kernel
90s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7c6af2cca4c96ba10b597616aae5578aa48ef039ceea578f56dcf77954c38eeaN.pdf
Size

558KB
MD5

65190d5e08f865da25fa10b0b4af74e0
SHA1

cc247a59b970566c2a4c4ff383d0d05e38e3debc
SHA256

7c6af2cca4c96ba10b597616aae5578aa48ef039ceea578f56dcf77954c38eea
SHA512

e8b79475e9c4d9c71826f4a2ec423a62f7a8694c48e50e2295370d3b493b64604e1980aee7bfa70b3c70ef0f1c9140d3574a56c6efb2fc91c7122b2ecfd10f8d
SSDEEP

12288:4OD56Kf5WMYODvvbkjhS13cxEN5JbbjTerb72D:L56JMdbR13NHfCE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2692	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2692	AcroRd32.exe
2692	AcroRd32.exe
2692	AcroRd32.exe
2692	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7c6af2cca4c96ba10b597616aae5578aa48ef039ceea578f56dcf77954c38eeaN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ad9c4d7431992bfa8e19d3b39bc4fa7d

SHA1
5d160ff7ab1ce1da4c523aa032631d00e284c7cc

SHA256
9581ed7845fc4a18905f865fcd58bf77a442280fef1fb4347c459afd1e044ff7

SHA512
53bb5eae15281e78c2fc29993e976befa3915b2f4161ddfca557bb5806634ca15884ab459927631ff7e2307c10dd9d2e29899fdeb2fa740aa5364417d176288c

Download Submit