7c9e38ad01e42d172c3312819a8ac2aac7db5e11af338904099985dbadcce228

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c9e38ad01e42d172c3312819a8ac2aac7db5e11af338904099985dbadcce228N.pdf
Size

437KB
MD5

c462457c9c45bed558188b7fbaa41ce0
SHA1

51b2ab999c997ba87c35cc030c62514f85981955
SHA256

7c9e38ad01e42d172c3312819a8ac2aac7db5e11af338904099985dbadcce228
SHA512

5509fae31bfabe8fe3c323e4ada00c8693b5846bcb67b3e2ca11541edb5cd525138123736a0cf547006641f8e09135d98ae7ace916e46626012d15f3eb8c50b3
SSDEEP

12288:kmJHj7tsXJUNbhw/rHGCEbJRSwHcE2GqwhaXTxOB8E5:jJ9WKdhw5Gw2b/cTxOBj5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1724	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1724	AcroRd32.exe
1724	AcroRd32.exe
1724	AcroRd32.exe
1724	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7c9e38ad01e42d172c3312819a8ac2aac7db5e11af338904099985dbadcce228N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
195bb52d6af4ba53cab719eed3ad46a4

SHA1
e68f6a07e6440e58c1fadf51e6201bc761e865e1

SHA256
24acbba220db29451ea4d27701bfd6b553a5a1f3ba0cbc6bafa8235d126d9c01

SHA512
d609cdbfaf3ee23d5efdf3ce17955f7c3ff373bd81ba8ff15233a8db922179e1fdbf3dd5c7c0f025c83cb3dd302f3015cadccc9b4feaa91912fc93d1dcfdc7df

Download Submit