37cd32965e993a14c5c613d307475e1590271d2afade215c464d980b13117966

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37cd32965e993a14c5c613d307475e1590271d2afade215c464d980b13117966N.pdf
Size

33KB
MD5

b6324c721ef78657be8b3208997fe2e0
SHA1

752980cd141ea4c327eda2aca68100d2131b7e82
SHA256

37cd32965e993a14c5c613d307475e1590271d2afade215c464d980b13117966
SHA512

ba008bd01423559da69bec3591ce6b55ef3e7a8d9a2224577b37b424b6ea343e28b69a517d806de276060666be639da90d86d4d66cc07677dff13aff4534feee
SSDEEP

384:oLBK+yEyt0alOZQilCltDMpk7KANGsHPcDqDT3orDiSyeaRr2Pir5D/3nrNB7K:Zt0akZQilCL7KmmqDTcaRJD/P2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2384	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2384	AcroRd32.exe
2384	AcroRd32.exe
2384	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\37cd32965e993a14c5c613d307475e1590271d2afade215c464d980b13117966N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6687c1b40f2f16bc65cac30aff011226

SHA1
2d3bfcd484fa74e93d324106df668454ea47f1ab

SHA256
17f638b708265098603d475a6cb65bafc67589e33c46154f9973e1660b9c3440

SHA512
b911617d8030fe2b9ba364958a26ca8985702802c6b9a99b654866852f5e10f55782d2816066ac22b4ae6fe4de78283f3c98445ffdce92c6e29fa53c2d68d80b

Download Submit