3419472eeb4ea3083a978a8d62ed7048ff6725ecb34f54ad12015b1bb2ea0765

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3419472eeb4ea3083a978a8d62ed7048ff6725ecb34f54ad12015b1bb2ea0765.pdf
Size

563KB
MD5

4492f5dbe7e6958d4e92c358d3e36853
SHA1

1bd154b2c150229110651d6f5457d0c4e325ecc5
SHA256

3419472eeb4ea3083a978a8d62ed7048ff6725ecb34f54ad12015b1bb2ea0765
SHA512

fc832746ad8b6a86972ec4761bf66791035d1f0b2d2540fb16e33d504f51a24b695c520c8a22d2353d700022296aad2afcdb71a073e900dc67be63353586c64f
SSDEEP

12288:Fo9RvGhFPf+9nsdtpU1lLCYN5sL1JO5Tjvz5kupqVjQpVWnY5v:MRvGK2dj9YN5sLm53L3pqlQpVWnY5v

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2992	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3419472eeb4ea3083a978a8d62ed7048ff6725ecb34f54ad12015b1bb2ea0765.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2ab0d20a1c0bcef8af4431e4262e0481

SHA1
cd8a435abf5c9708b7172e5d71c7bb9007836679

SHA256
54bba7a7f1ee62fabb096b351ebd779dfda988e9b920012daa058b6ae370c9b0

SHA512
f480e3e200fa1bc65a1b4c631a61261ff641fd67d5b429acf9a7c67cd2df74984aab64472a08c418c01d3af636616469018e4227fb0acd1156630cad3db74c21

Download Submit