302f0e3764f822780dba3f79a8a7cbef7e2f39350e2c189d231147229f8441c7

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/10/2024, 06:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

302f0e3764f822780dba3f79a8a7cbef7e2f39350e2c189d231147229f8441c7N.pdf
Size

53KB
MD5

3193d22a40789614a5934c72da0f0a80
SHA1

36a7bb21fcbe601c8c3053227114b3e30241971e
SHA256

302f0e3764f822780dba3f79a8a7cbef7e2f39350e2c189d231147229f8441c7
SHA512

1fdf24beaeadb6e4074dce402c9d82eaf9b2d6a979b966601cc633f41684305c463e88a840e5f7be82732326d3192bad868c927806905613848cb0e2988f5e31
SSDEEP

1536:GzIW1dMV+foY57tgUazA/LWiABHF7xWim:vWHMkzgUa8/LdeHfWim

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1732	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1732	AcroRd32.exe
1732	AcroRd32.exe
1732	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\302f0e3764f822780dba3f79a8a7cbef7e2f39350e2c189d231147229f8441c7N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4a370a116f294059e802b9d1120805aa

SHA1
6ba6d643995b59285ab53b1ae822d50ce734b686

SHA256
845b3c9a9c974bf2d91b588c2b2506a3dd4f888bdd5c6e435d9b36546cddd2e9

SHA512
11e8615e5cdb3ecd38909d7329ca8f41f147f71f95457b691bc47a57fb2177749296a18d4d25970321f04b0357898eb71ab2f478d02171c965924c046eb65f2e

Download Submit