eda17f48bf1e5d213081611c09583e5b275b4f0bd88f2e795468cf9989a2a7e8

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 04:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eda17f48bf1e5d213081611c09583e5b275b4f0bd88f2e795468cf9989a2a7e8N.pdf
Size

57KB
MD5

bf823bbd204316e529d5f21d3d91af50
SHA1

14bde0cef4571e2bb576515417b5d1fdaff9f1e8
SHA256

eda17f48bf1e5d213081611c09583e5b275b4f0bd88f2e795468cf9989a2a7e8
SHA512

5a7997c258056c9e547ea6176e7139739f900946a287a41e94b5d78ff1635b8d9ee2c8a469526a6cab2f6110efc948ea50ddc22d438826674ede6ba536d12fd8
SSDEEP

768:MuzdNIggou41dMV+foYlP13JvQtAuGKVoUURl0ERRD9jhp111bj7cx4:vzIW1dMV+foY5QtAuGKVoUeLpf111bM2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2508	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2508	AcroRd32.exe
2508	AcroRd32.exe
2508	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eda17f48bf1e5d213081611c09583e5b275b4f0bd88f2e795468cf9989a2a7e8N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e2cde388fa8190d2e21def588161abb0

SHA1
abea0efe6cf3528269c09412e1bf07fd01341976

SHA256
c837d5835a45f39853ba82d3f23efc766aee0fc0b61d05e9f29014e31ae0bc9e

SHA512
c07b25aa8febaefb77832478dbec698a4c5186c2abfaad70ec8991de4d499c68b4edadf3c80fb35e869f7efd23d5780175edf1031a4f3fb0d0b4d3f80bf99acb

Download Submit