4a3ac064de7088d37884a1ce329c39e876aaad97b8102fd5fd6985a8013c1c76

Analysis

max time kernel
90s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a3ac064de7088d37884a1ce329c39e876aaad97b8102fd5fd6985a8013c1c76N.pdf
Size

680KB
MD5

2f7299232f9dfe3fec37e3b3e989bf50
SHA1

52876eeee9a308d980ae0e86c906c4b2a0ebb005
SHA256

4a3ac064de7088d37884a1ce329c39e876aaad97b8102fd5fd6985a8013c1c76
SHA512

f55883c6e97aeab65c9f92e96f4da870777ad324fbed64f6283b51438f80a7ce46dafdab59203bafc7d571001dbf9e1ab621eb289872c296c49720b88988a13d
SSDEEP

12288:1cRCc8asv5A0018Lnl63aMWnsfsD8lKrdNUsJ3fMcfjYUdRDOnuml1ID:14FisaYMYKhNUQTjYUdRDOlS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2460	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2460	AcroRd32.exe
2460	AcroRd32.exe
2460	AcroRd32.exe
2460	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4a3ac064de7088d37884a1ce329c39e876aaad97b8102fd5fd6985a8013c1c76N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8efdbe6ea8fe77504f8992dd4148f461

SHA1
191a95a680d6ef1a3ea7ae9f720c38a1ac90f419

SHA256
38908c6a44f9887b6904e8ebcfa0ede5336cfb4f5e825f12eb5f3e6f1ed16896

SHA512
977400a3fcdd9d4fe6be017ec100e04c13900dd113dc551de246ee7611ec0b46d360f8ebf4ba040bb6787a79af1bde92499f7d9ec4cb78069130c8b8b963bc37

Download Submit