9f719ef114d1a98d36e98f1aa767b82d81ac2e50f46957900541d3447c82556b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f719ef114d1a98d36e98f1aa767b82d81ac2e50f46957900541d3447c82556bN.pdf
Size

368KB
MD5

fc98fb3fcb4744b1fb424d77036378e0
SHA1

d10852f99bee10d6dd52712895a891b1ab2f1e66
SHA256

9f719ef114d1a98d36e98f1aa767b82d81ac2e50f46957900541d3447c82556b
SHA512

b25f40ae3aa92f0be78f40972be6b14f330ca41a66a4bf29bbf48a25498b23acc00e2622ea79159c071530f33c6010725a917fcba8ce19abd4617797b3f6b8a2
SSDEEP

6144:gEYrEUWXhiiwHoD6YftNIgLwgUD68p4JPmTZTKG07O+Y9vtZCXsDYn:gEkgxiixD6gtegLP8p4cTdKGUO+YZtZM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2532	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\9f719ef114d1a98d36e98f1aa767b82d81ac2e50f46957900541d3447c82556bN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e25cbc266e47b17e38807aff82d2c83e

SHA1
f624ba4a825464c1e91571abb590556d29068197

SHA256
ed8d887dfc715e38b3db5e9d9d88d24dc964bc2aea2158d2b0f29421e16851ad

SHA512
ea71c7e4cfbc16c15d23a6f0fcaa9bd0f4ae5f69f30a78b422130b335144476ac55be664c350ac2c61887b06d7263f19da8f684860eb96b448c0eea1fb5d7dac

Download Submit