a5202fd91db5a85f7fac210011f7011c13cf11796ca451af69cbc186dd8d61bd

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5202fd91db5a85f7fac210011f7011c13cf11796ca451af69cbc186dd8d61bdN.pdf
Size

543KB
MD5

9b9cdf44881f41da4d07c6e7e7da2dd0
SHA1

9df2d77741120fdaa6c9addf6fb21c5a1eeb794a
SHA256

a5202fd91db5a85f7fac210011f7011c13cf11796ca451af69cbc186dd8d61bd
SHA512

fcde7a3f82c3bc1044a8a582dc10fb728bb14f7b3facd53aa1c67fb78e358bf473c08da26e1186bd8e30d20068e1fa399a5c44c030df0a60468014fd5e2488e1
SSDEEP

12288:NxNwP88WftndwFkitinW+/Wz4EgrgOhui9CVdMa12P:JwP88WF2rypuz4Eg359CVdL8P

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1972	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1972	AcroRd32.exe
1972	AcroRd32.exe
1972	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a5202fd91db5a85f7fac210011f7011c13cf11796ca451af69cbc186dd8d61bdN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e0e9c4012a8ddc0307892329462e607c

SHA1
7aea507221a9c21e86a8d40b877d98dd8af969c7

SHA256
51bac3035d4b854679d29ca8288ca8db9f5e24ffc62a1def7f4be6097c9cb51b

SHA512
6d8a6b549bdf3404a4f96e688bb4f97cd69b7018f465fc70cfa87f1045b4b336089846f52cc265d5c18d42f3da7e82fc4be4daecd5adca2f50a2c9e1967fc73b

Download Submit