d23facf1373a762869e8e333f2d3f48bde3987a19732bb6f8e4c7c0381429e41

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d23facf1373a762869e8e333f2d3f48bde3987a19732bb6f8e4c7c0381429e41N.pdf
Size

387KB
MD5

a32c4efb6a4e0bae128c16399e8032d0
SHA1

ea061edfc95550b60f06520ba4b608280bf853f5
SHA256

d23facf1373a762869e8e333f2d3f48bde3987a19732bb6f8e4c7c0381429e41
SHA512

e7c026244744a2cb319af498fffcd81037a77ab8f6706f02a778b50b46cf8041d1a7a66339de038b23cf5921c3bf7eb57da52957de1be8d3ab53a4f5fed2a4b3
SSDEEP

6144:22TKgzysH8u1OeP7mloQXnT7W2m16xojAw5wwDY:22W+H8u13PKlosW2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1860	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1860	AcroRd32.exe
1860	AcroRd32.exe
1860	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d23facf1373a762869e8e333f2d3f48bde3987a19732bb6f8e4c7c0381429e41N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ade4ea1a4ff37313f2aa31a333b131ac

SHA1
3455c0a04a963d35d050ccca7b79dcd14bbd5f44

SHA256
4209e808dc585c641a3642c0b4d94279edfa4844a79e71bf7c41dc379fd8f618

SHA512
736dbedb322d2394fb727c84218bf1ab4235ed1d86731d5250686928647ac86514843fc6142d212887e164a2b5aed896c1def4384b7ec5fb479d2d521675f5d3

Download Submit