5e52050b81c481dd47624208c76d3ac2af4bef3102ab96c4992c58dc5a0d4221

Analysis

max time kernel
96s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e52050b81c481dd47624208c76d3ac2af4bef3102ab96c4992c58dc5a0d4221N.pdf
Size

429KB
MD5

791d1600a7bd1b228d3b26e0bc8c9500
SHA1

ff99ff93dc68906f182a31e651bbb24bed314683
SHA256

5e52050b81c481dd47624208c76d3ac2af4bef3102ab96c4992c58dc5a0d4221
SHA512

6f6971a1f9f767c359ce4f2ade9633b00226d4d01a1e39b003c5b71713499d84a8fde0106153e2ec600546c3abe19a1e4d783136d4649669538f912d7afc61c8
SSDEEP

12288:GOofI7exQw1vtsa65b+aHCsOKh/qoAKFJGc:Dn7exttsTOKNqqJGc

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2068	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2068	AcroRd32.exe
2068	AcroRd32.exe
2068	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5e52050b81c481dd47624208c76d3ac2af4bef3102ab96c4992c58dc5a0d4221N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b024ce77dae9bcf1568ec595e2a136f0

SHA1
bb1be765da00b92d8a80d4d4bcdd4392a90e1bd3

SHA256
5d5e5e52047fda3c71bc856d6ee3a35239fc5d79c796c5232ecbb5d2676582d5

SHA512
1964b7873afd2793408b66b79b2fa4810c6b8dc197141a5b9ea6d9f683a3cefa44f8f9521ef6bac66bae23456ec77f1a3345241367858b3b1b5b495d935230d5

Download Submit