02e38c2d97589c780e7c8459d37dfe7e82c1a6a1cc896be617db6fce6138e649

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02e38c2d97589c780e7c8459d37dfe7e82c1a6a1cc896be617db6fce6138e649N.pdf
Size

1.6MB
MD5

d96b07433e01d38c4d1f7a42c9302b10
SHA1

d5972b94e3310d5e93f6e87b35733da097e221a9
SHA256

02e38c2d97589c780e7c8459d37dfe7e82c1a6a1cc896be617db6fce6138e649
SHA512

2a16b712e22038ebf8e29e5dbb03fe67cc3dfe0d6fdd499eab5b3f822ef559c5116dcf9aa575415df89724b6bd65648f72e914614f1889793e32ccba0865e35f
SSDEEP

24576:V/yEl7qrraXbMCqjb8mF64h9fcykT+9pg/yEl7qrraXb+D:V/FluraLMCqH8mFZw2W/FluraLc

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1972	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1972	AcroRd32.exe
1972	AcroRd32.exe
1972	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\02e38c2d97589c780e7c8459d37dfe7e82c1a6a1cc896be617db6fce6138e649N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cae76ed1607d821866c12304c4652009

SHA1
0e89260883289e1c9b541fc61816e365f24dc8f0

SHA256
d850245a0e9b81e3a68e9b27a4efb623fe82c5a2d2053b551abb9f6ca68422cf

SHA512
b0d598f3ed90bb77e82ec345bb4b446b1e78e9b166e336d07509ea39e7246334fe472dfbc84cd4974150d4671cc94487c255c8ef577d469a877e570c0869ee9a

Download Submit