0f7b5d5ad44cf5df8ecfc5eb391d0e02907ddc5efec983de73e5683bf1c269b0

Analysis

max time kernel
90s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0f7b5d5ad44cf5df8ecfc5eb391d0e02907ddc5efec983de73e5683bf1c269b0N.pdf
Size

318KB
MD5

95b56ffeba117b58c591a960c9fd81f0
SHA1

12a1dab0b1fc2a42cf6b1e8a78511c85e65f9a9c
SHA256

0f7b5d5ad44cf5df8ecfc5eb391d0e02907ddc5efec983de73e5683bf1c269b0
SHA512

7f6f2949432fbf086cc93e45aae692a82e76bb1ab4ae99028bdcfd04a878c77bfb1426319d5f7e86ede287cd37e16f95a905bc66f3ecd9ef72e142a935d3ffc5
SSDEEP

6144:m97Hr6DuvJZpSGw2ruCeyh/lrSSbreDcRxZ/k7YlkjP4j8YOUZCyAY:qZlSFvCtHSlDcecdjBkY

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2188	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe
2188	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0f7b5d5ad44cf5df8ecfc5eb391d0e02907ddc5efec983de73e5683bf1c269b0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
453c8c01a6be20c7a6ff08f178289a38

SHA1
a5eba05ec04e60a711ecc63b596434250290a291

SHA256
0aad236251cbfca38c8c10fb056b9c516a58b5f244da9aa5a4f8209539b7b97a

SHA512
c2cbecf11dc9a9ac342d9147b0334852d5cab1ee3b8b80c128454463ecda5dc30063174cb7ce16e3f9876c896c4a8f56c2447c7f4cfe11745ae4b3382aab9c43

Download Submit