0e2873b6b02a62d51fb6170d75e307c519370826c3e8069f32e70cc82e11b0dc

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 00:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e2873b6b02a62d51fb6170d75e307c519370826c3e8069f32e70cc82e11b0dcN.pdf
Size

331KB
MD5

b9c005c667110ec85ade547257c18520
SHA1

948c8c8cbb8ed6cf61a5fbbba48d3985a340ec92
SHA256

0e2873b6b02a62d51fb6170d75e307c519370826c3e8069f32e70cc82e11b0dc
SHA512

915909c313f4cac6ddfb4600631ff55be69785ff1d76faf363e8675cf7f76d8d475ace796e9f73bf91e9335e3f85100178004958032c46c2e3ea85acd54cbaaf
SSDEEP

6144:2YUQ0tP4d8350sqMckmhyIvRqk9G3LJU+zD3wfDAVP3kPKQ:jUQ08835gMcvhxPI3VU+3n3kPKQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
764	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
764	AcroRd32.exe
764	AcroRd32.exe
764	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0e2873b6b02a62d51fb6170d75e307c519370826c3e8069f32e70cc82e11b0dcN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
690b798018dfe3a7217cd2ee4b0edcfe

SHA1
d194ebbcc97dbed414cc8257c32788bed4b5a209

SHA256
f2aab8f98d9dd86f9ed33de9d954f4b8dfa49558f0bfc4e91013b9cd9c13b078

SHA512
18ca12f6aa655b86693ee1d3e45ac3cfc10118392182e518541eb0b11345d201de75acd38df79cf9b23c0311fdb7db626ec45927ce8a49fb75fce48048d6fceb

Download Submit