71718b37395fcbcbb101de3c25304840b87b71ae6b1cbe4735bfd379abb7da6e

Analysis

max time kernel
96s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 14:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71718b37395fcbcbb101de3c25304840b87b71ae6b1cbe4735bfd379abb7da6eN.pdf
Size

76KB
MD5

153a8be9a4ae88d2cfdb3ecc6c83d800
SHA1

8799fa58b30474bfd87575c29e326b59341475a0
SHA256

71718b37395fcbcbb101de3c25304840b87b71ae6b1cbe4735bfd379abb7da6e
SHA512

ba6382991ebdcee37d04295ea981254616d15972a78b1403dd1aa6e0d1a1260ac4a1529d6d8df855de313f48e0031ab709c69dd5a50e87ec5021f148f4638d2f
SSDEEP

1536:kdqGVLo8t4ROtfLm9TnOXCgDF2222WKfTd6:kdqGVktAtyOyusKfTd6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe
2720	AcroRd32.exe
2720	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\71718b37395fcbcbb101de3c25304840b87b71ae6b1cbe4735bfd379abb7da6eN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0988a0f8616c3c88b8f0484828f67e0d

SHA1
a25368979dd95b923c49a5f5f4538ff24350072a

SHA256
4a9d049770e76894848d710a38c90133dca872e2c0e350e2d01cb08971c2fd16

SHA512
98b9fdd025c297c4f5a994dc25bf40add2ffcf09998357b3e13fab71c7a5bdee00e4b2cbe4eb38c0f194b1ec197c984bb7cbda7c627c54151b7198a3d661bb46

Download Submit