f715d62a2920bb14859fdab55bf6138de913fadfbddd5064ec5e4bbcc696feee

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f715d62a2920bb14859fdab55bf6138de913fadfbddd5064ec5e4bbcc696feee.pdf
Size

292KB
MD5

3df9427bef060cc112369ca9473c4064
SHA1

1ccfeae60656d791c1914db5bb5f113e5aa236ed
SHA256

f715d62a2920bb14859fdab55bf6138de913fadfbddd5064ec5e4bbcc696feee
SHA512

3423ec31c52358132a1001817268e5a8e7303bdd1689fdc493d0668214b37713eb0b3b481f59d2a6097454c735f5a32e9626e17d25cc8344793817c61536bc98
SSDEEP

6144:+YOsWAD0CrIsSOfnn28JF09D93tBii8/uu0UTIV82EC:+UvMsSO/28j6L1ShC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2100	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2100	AcroRd32.exe
2100	AcroRd32.exe
2100	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f715d62a2920bb14859fdab55bf6138de913fadfbddd5064ec5e4bbcc696feee.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
74db0a1048cba8438c11fa50134feef0

SHA1
210343ee020504e45ba9f33efaeba1e0b877c69c

SHA256
3396769708569b3c2e116521a326219b5d362d7622017b6f359d83837d212a59

SHA512
d525d2124832c51e221ef182a8b4d31f16c171ce98842155c82054c777333062e2f833be2e563dc10becac52e28a4ce48500af14eacf74c545daf8e788d5f3f0

Download Submit