5fec902d098ffe0801f8bafc0336b49e4a3ae3384edead82f3aef5979bbfa488

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fec902d098ffe0801f8bafc0336b49e4a3ae3384edead82f3aef5979bbfa488N.pdf
Size

368KB
MD5

bafd2eeac3c07cfc1f0a44a979205cc0
SHA1

af3c46f7ab4e44ec2f99212f4e34d45534bb21a8
SHA256

5fec902d098ffe0801f8bafc0336b49e4a3ae3384edead82f3aef5979bbfa488
SHA512

386eac7ef212e9722d4514437acbfa8a1498bc2ff43404dcdd8037d47f2f772e6c9d36a720d7bd44424556861fb4319602a37681c51c83781b6f147a669a19a3
SSDEEP

6144:7rnFsTy7N1MTjahDWpOcOyFX6zXQ9I5SauYmz0F6Bp7iarVB8NOq6W5PNSRO0xEL:XnFs2qjacpqyFXEQ+NN8BBikENOq64Pz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2512	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2512	AcroRd32.exe
2512	AcroRd32.exe
2512	AcroRd32.exe
2512	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5fec902d098ffe0801f8bafc0336b49e4a3ae3384edead82f3aef5979bbfa488N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4d353e0c89618de0bbc8101d8b917c94

SHA1
9ad25a4c8a46ebcf22993dc960ec2c4c80e6e680

SHA256
721892acdb83e240abb698342347831ec3f5d0502e2c5a02763b4bcb87fc820c

SHA512
ac8aac5ecdee359fdef78d37463949ec75c2475689e1a97bce2a59a26a0244705bdc0b34720c3f4015d8a26db0b2e7cd8ec1cfa661475ec367346a3c7e70f2fc

Download Submit