7ffc2315d1bc27db73dc91f51f39dbaf54736da474a2c25e441135033a44cbcc

Analysis

max time kernel
90s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ffc2315d1bc27db73dc91f51f39dbaf54736da474a2c25e441135033a44cbccN.pdf
Size

573KB
MD5

70781bdcfd96361aa62529c486459940
SHA1

9b1ef5d7ac85b8cb5559a9de15cb8b9fdf00d95e
SHA256

7ffc2315d1bc27db73dc91f51f39dbaf54736da474a2c25e441135033a44cbcc
SHA512

d745fcfcc88ded42911cb6ea0b722792c7e6aaab038062162b341328d123f5fe7831a8797818b9362e061459c47c19c9720264631da0a3ee6d3d63404ec26070
SSDEEP

12288:P/o9NjIK7r7lDTD/Hh+r9igL24pa7Fdztl8F2hd4BRy5Bb8iZWp:noHVhTD/OrL2Sa7FZD8Isnigp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2512	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2512	AcroRd32.exe
2512	AcroRd32.exe
2512	AcroRd32.exe
2512	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7ffc2315d1bc27db73dc91f51f39dbaf54736da474a2c25e441135033a44cbccN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
346b86f0e4649e08a61558c2f6d57d34

SHA1
4973f19eaad9e0361121bc85028b3f88791f0b1e

SHA256
a8139aba3e81a11278a4fa6a24286d93a2f93277375811caf25383c122ae4802

SHA512
42fa4184a32eb3829e2f2b19908c20cef74603371a33beceda4406e907eb6df4294bb3ad003bb6a0ccba5d348f501f9ecf5d1692446dd75ee32996ec8b1511c1

Download Submit