b76d4010f77173da623072453dbb49933cd5112b1795c815524f93b691e50525

Analysis

max time kernel
90s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b76d4010f77173da623072453dbb49933cd5112b1795c815524f93b691e50525N.pdf
Size

396KB
MD5

c74795063a711d9b000475072d786090
SHA1

598f71c17c82b00b9e82d5c57fd449fddc5a7767
SHA256

b76d4010f77173da623072453dbb49933cd5112b1795c815524f93b691e50525
SHA512

8e8bf32a0ad885964238936530844540a2cb0239f28d699627e40fdf576fd8ef32555ec35b488b957c9c96d25a18b3d13f1dc30ff89388dd481c9dd31f3e12af
SSDEEP

6144:saj9zEkk2sk7GD2DjhqFnV90uD5b5ZapUAAwxiXug0nzXtDyb58cyUFcCPh2tqBL:sapgh4qFV9zD5upswkXXmXkbyCp2Y83I

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2908	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2908	AcroRd32.exe
2908	AcroRd32.exe
2908	AcroRd32.exe
2908	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b76d4010f77173da623072453dbb49933cd5112b1795c815524f93b691e50525N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7242dc7f4f97f355b8fae4c44e37a778

SHA1
0ffa3fda427f16891f04b50fef74abd885287e40

SHA256
469dbad1d6214e8dc80d39eeed5f4786cbb5851dbf43d2f335b022012448f04c

SHA512
1d5de46640baa71557a0ac4d4164611f2fa8453e10e054974ef1c8ad768412ff03286998e1e19f79ff43aa07711fc795eb4f0eaabe801c2f9c1cdd5071375136

Download Submit