4c32225f5cf0982188f808871c3e6584c2d7706826607b7f25feb9a3385d83bd

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c32225f5cf0982188f808871c3e6584c2d7706826607b7f25feb9a3385d83bd.pdf
Size

274KB
MD5

7d16d4729eb811c65c6a3ce47744dae8
SHA1

18724afe81c6e1b9d598e94ea3ddd1984f3929e7
SHA256

4c32225f5cf0982188f808871c3e6584c2d7706826607b7f25feb9a3385d83bd
SHA512

60a92e495f4fad70a71a5bbc65c9ce27a0d534e7388f8b4360995fdd169baa69180ec74cd64e882c0ba55f04e020d9dc462bf9643174412ed2ed9d148aecf78e
SSDEEP

6144:MA57QVYIoloWtZCaWW5/F1tY1YM2KbSW1Nd02i:MA5KtyX65WRF1twPZv0D

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2188	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4c32225f5cf0982188f808871c3e6584c2d7706826607b7f25feb9a3385d83bd.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d6d367fdd9a9dd49cb3646de662f6a9b

SHA1
cc6e734e4af7a08fc942e8a288f4f25d7f8d003c

SHA256
58a7c16d9887db0ac0f7cbb21a5510d8473f10fc0088a8210cdb2eae7a12117b

SHA512
25d52148f58b6fa32c17d7ec30c45b2a65beb5b8c6b8239ded6699bfa84ac791ea6262ec016c83d09a5c370361fe02aa47f24b0eea78ee7ea3d87fc5c373682c

Download Submit