7aedba45e0fb7dc0dcfd8a5b0e874a2c743330d8e427e6b89abc78ae3f97fe2c

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7aedba45e0fb7dc0dcfd8a5b0e874a2c743330d8e427e6b89abc78ae3f97fe2cN.pdf
Size

54KB
MD5

1ae5e7270954257345070222cab2a010
SHA1

bc7875192339f70986b80b2b560768691ac8fb8c
SHA256

7aedba45e0fb7dc0dcfd8a5b0e874a2c743330d8e427e6b89abc78ae3f97fe2c
SHA512

1b1560f5be32a74dca848784241d1abc05804d355cdef8f7ad2f0e78429ddd35971a09b6f95f72a7c9aa7f8b7c9e22455524eaebde3cad15c70aa2b4fa10cc78
SSDEEP

1536:/CPtwY/mnVeno+2rNdcNn+XaApZqObWaApZqngS:q1NunVeL2HcN+XNbWcgS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2096	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2096	AcroRd32.exe
2096	AcroRd32.exe
2096	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7aedba45e0fb7dc0dcfd8a5b0e874a2c743330d8e427e6b89abc78ae3f97fe2cN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3f30fb2c3982b2c45adf9c3cf5c8d75c

SHA1
c90e9d2507bece4e222aa94bbb2e9c33070a3a78

SHA256
c9a88cfcce4136d4527374203b97081e266607672d4544e17b6a96de3c0c3af8

SHA512
4fb75b4d207c3a52d10c2a2d569787ec03622e6aefbca5125809682a7b3b2e85702ed828b785cf44b36a44ab387e93f3573eb55ab3833bc95e6da97eae6a2456

Download Submit