91f9c0a2c75639e5e58b000bc62c82a3c3e4f1bb79e6a2a3fbc28543822124ac

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

91f9c0a2c75639e5e58b000bc62c82a3c3e4f1bb79e6a2a3fbc28543822124ac.pdf
Size

471KB
MD5

435578fa9c8275c5ddbc911260b842c8
SHA1

2935a69c23c817375adafe7eaa81337c9bb40571
SHA256

91f9c0a2c75639e5e58b000bc62c82a3c3e4f1bb79e6a2a3fbc28543822124ac
SHA512

a4b494101a164e9b0be5deed4b82b02066fbb814adc48d8c7314d82721a48da9c41b028d345979ed9111a5ae461e0532278f24a2b8255db62138ea6a159165e6
SSDEEP

12288:wll1j+pk6qvBYFxUhPkVZX8ZNEt70HcaEVZwa59ep:klOk6qvBbkVZXJ0caGZ5k

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2712	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\91f9c0a2c75639e5e58b000bc62c82a3c3e4f1bb79e6a2a3fbc28543822124ac.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
69adad0ca7a638c145c09350cf5a0290

SHA1
af1a6976e116d74098e856d8ffe325024f842c91

SHA256
cb7dc247de48b2c2b24780ae9dcfbd180d7c504821664cf6fb4232c9213fbcb7

SHA512
dacd8e80205794e9ec5bb3b838e619b7425e5d528a72c44f7a7e07a113310b83cfb9cdb98ef2f0d845d0b79bce07f371c16ed9bebd8f99e81737df5bd797182b

Download Submit