b6b6c478888efd6e4751e5bdc6b58e31f7a1217b828486fea235a41fe71def03

Analysis

max time kernel
90s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6b6c478888efd6e4751e5bdc6b58e31f7a1217b828486fea235a41fe71def03N.pdf
Size

446KB
MD5

3a91e854c1be293a8a9c69c9eb8125f0
SHA1

ea6446c2892fc4eec0a55b179a8e6d659725c363
SHA256

b6b6c478888efd6e4751e5bdc6b58e31f7a1217b828486fea235a41fe71def03
SHA512

9e6c7f260d19b78b2595acbcd84cc32cc6e66918d50879349129bbbb09ec0f3c31176b057763670d49789fd215f553d798c62bd1398faa8d2dbf42ba96dbdec4
SSDEEP

12288:a5xOb+eIY2f39eOCcK3jTDd6q7plRAhxRo2OoDxEyBe32wfju9yA:S4CY2lZRMTDdH7Vuk2OKxEoe3DRA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3060	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b6b6c478888efd6e4751e5bdc6b58e31f7a1217b828486fea235a41fe71def03N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
07ed9625680c7b63dcc2693579d1a16f

SHA1
6814a8c881c1429361aa828056d19992b8c9690c

SHA256
dc3f89dbf366d9cdba534da894eae2797ab6c4c940f20d5378ab1252758c4f6e

SHA512
826365b20e7cbbcdcd00a99e105b0eace74fb74d16dc1c8be15755bb716d0c97aab5ae1e57c2ed90adf6ac13f65f5d339048b7771235162037108c38b440d3af

Download Submit