0259f8baf94ec1fcaa099ee0219dfa590c406cafcd8096b8277e3f39c7783787

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 10:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0259f8baf94ec1fcaa099ee0219dfa590c406cafcd8096b8277e3f39c7783787N.pdf
Size

57KB
MD5

aa566f3ce705225d1d8e00d104fa51e0
SHA1

75eefc7a514b0baf505a02725bd7721f6b97339d
SHA256

0259f8baf94ec1fcaa099ee0219dfa590c406cafcd8096b8277e3f39c7783787
SHA512

fc05e48db189f083796a1b436bd99c977f0de7bfb1ad169faeeba740d2f291bce6e181c3fd87fc79d039f4a18934721dd20db2a33ea308b2ca87bfe5209fa244
SSDEEP

768:YuzdNIggou41dMV+foYlP130+/H6qg3RqfTmS45nOvl0+zxOi:DzIW1dMV+foY5dfJCFS45n6l0+tOi

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2384	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2384	AcroRd32.exe
2384	AcroRd32.exe
2384	AcroRd32.exe
2384	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0259f8baf94ec1fcaa099ee0219dfa590c406cafcd8096b8277e3f39c7783787N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
182f677ad021f378f9b002352d607c99

SHA1
312e5c2242f0cdb6d2768f1d566b8aaa493f993b

SHA256
d16e2bba6b0b2d6c22076daa8a6e47f0e9a47aea49a17c804688c4a3d1b0c017

SHA512
b4dbc313bf65f819f2e438eb69b6aaaf8bb999652a61b06ebed3bc89be1a7dab58dd16e5dc60aaf196ddaef924ec1a657d66849e74da4ba042497ccc3f7ea260

Download Submit