4016541b426a03fe8b143fe031b87ee62b633529691709fb25ff61a1cf25f04a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-10-2024 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4016541b426a03fe8b143fe031b87ee62b633529691709fb25ff61a1cf25f04aN.pdf
Size

382KB
MD5

a52f850c3bc361bef1566e5b1d27f850
SHA1

339634074a3e39ccc093b275cdd61b189dd975da
SHA256

4016541b426a03fe8b143fe031b87ee62b633529691709fb25ff61a1cf25f04a
SHA512

2e1afa0cfe62540b0706ef853050601030a6776e2eccc1f7f90b51b8ef3a6e81e69e607b0bf618ca5672f824bd413b1278fcdee3315bfce6c3938db3c5866d7e
SSDEEP

6144:gILBVk6L+gqgBKJnwixNUDZaalqp+b1FKdndLl66nRCmqsiIbh/RFJ/Zj:g7Y+gqTwi4Zl6JHo/zUlRRj

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2900	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2900	AcroRd32.exe
2900	AcroRd32.exe
2900	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4016541b426a03fe8b143fe031b87ee62b633529691709fb25ff61a1cf25f04aN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6254b68e0c97da3dd3ba2f39bfff987a

SHA1
7fb1a13cfff23b1dd008dc71ed56d60ad44ce0fa

SHA256
8c243c4fd55883cd0c357e74c971128a87d883354772a9dc7ce73098a68316e1

SHA512
55d1b7c413285f187d0dcdd4c14d6322f3718f136b54809817b4eacb141c9d02976ed3efd20d6985d3d692237b203bc646ffc5bd3a68fb6c73af7c73bfed55bf

Download Submit