a4bd440b87e337a766c329e08c2088852a72245c259169f3c5991e08623918b8

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-10-2024 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4bd440b87e337a766c329e08c2088852a72245c259169f3c5991e08623918b8.pdf
Size

77KB
MD5

16f142b3091d1fc5611467a9d997eb6a
SHA1

e330de92920a16675a89f7f14071e657277bac7f
SHA256

a4bd440b87e337a766c329e08c2088852a72245c259169f3c5991e08623918b8
SHA512

668f6e8347a2a82ea422aeb220ebc73b21e1ea67a73731fcd714275b5cf29d71d141344aad76fb70a1f02716b9d8dd21f32871eac009cc71615230d5562a4ef7
SSDEEP

1536:uA0Q+wvEFyIgbGZnkhS8xEvCNOZWLQeeEDWDrt0tequH:qQ7gyIg0khFxOCgeJLih0ten

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2548	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2548	AcroRd32.exe
2548	AcroRd32.exe
2548	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a4bd440b87e337a766c329e08c2088852a72245c259169f3c5991e08623918b8.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9873d7905060b138a20007b7ec783d54

SHA1
db31d131a0561c3da927be46647a63650d7d9159

SHA256
288369b2f150245aa859fef501031b94b549f957cbf594791d1b7f04dd150a06

SHA512
ac094cc194bb18a428b9b9eab7799c640d63ff5e669d8fdfd557869bec956978efda633295680f6a8a4fe4f3ef7dfd444b605ad8b3ebf6b40ebb6ca08ecdec4b

Download Submit