07d5e601329f72bef4bc81ea69f48acc70e381d7de020ff47271a5a1a7b3ce3c

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

07d5e601329f72bef4bc81ea69f48acc70e381d7de020ff47271a5a1a7b3ce3cN.pdf
Size

472KB
MD5

65919ab64fd72870cc1c7dd22e18f0a0
SHA1

820b32b476b962a93c980c529a8734a07a4f14d3
SHA256

07d5e601329f72bef4bc81ea69f48acc70e381d7de020ff47271a5a1a7b3ce3c
SHA512

0ab25c81d3991fa9d0146d518132e881404e736e81cb9b7f1f57fa3e8600a8172b1382e9fa7e0bba8fe37a0f53a0fcd43389df3258fd49b31146ca49c54fa902
SSDEEP

12288:s+MZotL75wtccbKU3uVv+aCisUK4E6DAaHL+uEBg:s+MZot35EcyfdYfEKXr+Lg

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2124	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2124	AcroRd32.exe
2124	AcroRd32.exe
2124	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\07d5e601329f72bef4bc81ea69f48acc70e381d7de020ff47271a5a1a7b3ce3cN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a3f03372e3fd4d696227537cc87e0b88

SHA1
572d70f309a73754f59beba8e1783f7633db0628

SHA256
aac1f75f5d31f09b084181c2a6fc3729c0435bc0f1f56e14ade3afaf0d50ab3e

SHA512
ca3264b797360bbe47c5bbaefc5d4d8a09ede1e69ab4001c115825a2be2256cebc4745b4436545702db7bb8d201e41d17c21971cd0f5507c801998d130644d44

Download Submit