797505c32c37c160164d28978ed2833ac3e438ae7453efdf23d9ec7ee3adee9d

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

797505c32c37c160164d28978ed2833ac3e438ae7453efdf23d9ec7ee3adee9dN.pdf
Size

293KB
MD5

f65ee4ce58aefffe56583f21ddf85480
SHA1

75775deaf1904d047bcabc69a8c8c26dd622a07a
SHA256

797505c32c37c160164d28978ed2833ac3e438ae7453efdf23d9ec7ee3adee9d
SHA512

d2c391f19d983cf0bf3357366bd1d7cd74598ff567aab0395cea54cf45ee632573b611dbf3dd075c548936781a458ac80eba0bb7eda153ad02126d3e4ab6caa5
SSDEEP

6144:04z0d/uQQV0mSsOGvKwaXg2AASzj4+JwrDj+48P/UHLQfy9X:l0s7bSsRb4PDRmw9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2436	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2436	AcroRd32.exe
2436	AcroRd32.exe
2436	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\797505c32c37c160164d28978ed2833ac3e438ae7453efdf23d9ec7ee3adee9dN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ddd6725ed9136ad74f4811c9d4aa820c

SHA1
65b499c47074b11126565a2f6c0692f3a8a84e89

SHA256
fbbfb5372fdd0f8f2025380b87ed83ede0f8c656ee0ead1247cd5f84692b1c62

SHA512
cac8fefe271e2f9a536d4f0c7770fa40841f0c23aeee594a2c7a2e29448844c34ca3357297fada87eacbc7924bc4281a934c2814fce506ab8726e87a0c0e17f1

Download Submit