ff332c2848414c9c9e857f50416da243e87f59223297cde40dfeb1762f563484

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff332c2848414c9c9e857f50416da243e87f59223297cde40dfeb1762f563484N.pdf
Size

414KB
MD5

247907dd4b9a05680b7174d2eccacf40
SHA1

dadab0130e2c688378f55b50ca221315e49f7639
SHA256

ff332c2848414c9c9e857f50416da243e87f59223297cde40dfeb1762f563484
SHA512

621a074571f545a1679f00aa7256b1ef6586607d105958417e37ad8f002cec97ec5d6da794ab4c1c68d46a3a3765da69ea8345573d29a5449182aeadfcd026a3
SSDEEP

12288:Sj0fZDwhFYLwLUml/svArgdMK6sQH03tbFBOmY:lfZMFYcgG8A0dMRFH0dTOV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2432	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2432	AcroRd32.exe
2432	AcroRd32.exe
2432	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ff332c2848414c9c9e857f50416da243e87f59223297cde40dfeb1762f563484N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5c81645efc2bf3a76c0479c1dff34a59

SHA1
3b0093a1595ff7f786026c57f355cd8610ec0684

SHA256
e131f5c3b685ec88e3cd909071a9e737f1f70bc7678027754f447d69bafa156a

SHA512
e66116a3c7fce36014014b8d50e6cc76c9bef330ad9110279a2d40051ee8b4dec753a6394ab7a257838c2ac5e188c4f003151c84a9a9b163b86484fdb0ad0daf

Download Submit