0e55a1afecc284dfdb69e48cccaae3ae756d762e6187a737b1f22b702b00a084

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 09:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e55a1afecc284dfdb69e48cccaae3ae756d762e6187a737b1f22b702b00a084N.pdf
Size

74KB
MD5

020d9a4c1a67a166bd48d1ad9a0a9910
SHA1

3263260f3015427f16c0373731b51f436544dbd2
SHA256

0e55a1afecc284dfdb69e48cccaae3ae756d762e6187a737b1f22b702b00a084
SHA512

0cd0db32b7fb2614593277a390cdfe2acbced6e24bfdf2588ff0f3fb2da05a6fa6061913d48b440b9258d473417fb1204655e6f90459e85c6e7d7fc36e9cb589
SSDEEP

1536:XdqGVLo8t4ROtfLm9TnOXCgDF2222WquAdFTeDNwRXiq:XdqGVktAtyOyus7AdgUXiq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1316	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1316	AcroRd32.exe
1316	AcroRd32.exe
1316	AcroRd32.exe
1316	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0e55a1afecc284dfdb69e48cccaae3ae756d762e6187a737b1f22b702b00a084N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
559fc845cf30f6644285a19f19b68228

SHA1
e24ebe0f04214d2061f55ac9126e930c3a9b4a47

SHA256
1aebee2087a5e3efdd66cf7d0b7b151dbb4babde3f4819c08ae69f4a22e8a941

SHA512
3924de57513e8081dfdb79776851bbd921c69aac1987c3e1481a52a7a45c6bf7265d7fcfda33899239f7704c0327584472be2bf2d36b605eec1ecf9af5353cc9

Download Submit