015128de13fe91b4f6712ecedcf65df74a377b9ae5d2df0c71ba3b5bb56795e0

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

015128de13fe91b4f6712ecedcf65df74a377b9ae5d2df0c71ba3b5bb56795e0N.pdf
Size

472KB
MD5

32bcd678fc1be06ebb763a0d3f775e20
SHA1

fd54a16d3acc45cae84b7f5686844225eb7062f1
SHA256

015128de13fe91b4f6712ecedcf65df74a377b9ae5d2df0c71ba3b5bb56795e0
SHA512

5b6a96500fa97476cf56ae26846e8c2daaaeb7a43dc67bf3aeb415f9bed5882a5b59367fbf81a76a5d311d153023e5ccff6dcccdabc6796ef99d3cb9cd8524f1
SSDEEP

12288:ATwDojthooXCI4qf1bJIXPF5VWTd3hRIN/xUdnl1wNq:vKtCuCBqfvI7Ip3hsA/j

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1864	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1864	AcroRd32.exe
1864	AcroRd32.exe
1864	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\015128de13fe91b4f6712ecedcf65df74a377b9ae5d2df0c71ba3b5bb56795e0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1325f010664548a73edb9befdbf66495

SHA1
3e20f41c35ce1763117f2eef460a68b10e48be62

SHA256
7c35ffc3808cbb383d88f2b023ee50d39f05dd836836a4b55a054b0772b76af6

SHA512
d0bbab552d03703065792cfb7fea4ec13e9b2635dccf40bf36ad2355d7a32438041fe4da7f3d4b04a6edadfab25cb27e3cca92a6d69e61e8dde3709184aa6389

Download Submit