e39309e1f8de2e5d1af3222dcb7969afc5e95f08223b52e121e50ebaa11ded23

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e39309e1f8de2e5d1af3222dcb7969afc5e95f08223b52e121e50ebaa11ded23N.pdf
Size

43KB
MD5

328483c91673cf852e3bee9028c66590
SHA1

32dddbaa9b3c96f888b8645cda1207ede83c2b48
SHA256

e39309e1f8de2e5d1af3222dcb7969afc5e95f08223b52e121e50ebaa11ded23
SHA512

55aa361d23ba23b6c18897fbfde15ba79c38af29bd6f47063d4d89cad266c92080603d8543088045f5eb5376b82cf7f790ad92fddc1e905ea1d8b99354c1512f
SSDEEP

768:lbwOuKHz27jUzW8s8rs3gDM+E/a0Rzjxnt28wtfh4iQ9NvAbg:VvHy789sO9M+ORXJt2DZ4iiobg

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1972	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1972	AcroRd32.exe
1972	AcroRd32.exe
1972	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e39309e1f8de2e5d1af3222dcb7969afc5e95f08223b52e121e50ebaa11ded23N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
09437f2cf29cbb6bb8bd7129b7910034

SHA1
1efa9877b2e104e98472b2657214c5e1b9d2c697

SHA256
691cb406a3e451bb978a2543edc96d78cf81fb40093f3c340b7d465550cf478a

SHA512
e8790cf13c5eb62f47834e479e3b71e785796f13f87ce71380fa13445b0ff4ea02328ac721a6fef3ad5544cad9c7d3b68d21b9db77880ce6f6fd0177daff0c4a

Download Submit