175cd0b5d6e994027888f9f54a6d090c4e3fe7867b727108ce633e125db639ba

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

175cd0b5d6e994027888f9f54a6d090c4e3fe7867b727108ce633e125db639baN.pdf
Size

59KB
MD5

d5a0f36f28933483d578351e7270cc50
SHA1

20dcc6f3519d571b7fe2658cfd468bf145a4ffcd
SHA256

175cd0b5d6e994027888f9f54a6d090c4e3fe7867b727108ce633e125db639ba
SHA512

2fd271e3c93b54ba1b4f2b8fb3f0f28c9660a6f9dae36cee3fea76ed98bb2571813429ed48529aa4d1b9be2c05ea10f5e7acf6fc1f1524b298a151d7056ad705
SSDEEP

1536:wM/EYZpF12YJkGK23go58ESy8Mp2gP11PREp:w0EAXJm+55SyNpx70

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2232	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2232	AcroRd32.exe
2232	AcroRd32.exe
2232	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\175cd0b5d6e994027888f9f54a6d090c4e3fe7867b727108ce633e125db639baN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4614d826bd9af64110220af3f0979f2a

SHA1
f450c37e89b7c323991237852eddd86283301d1b

SHA256
8e3fea05f299dc63ec221b4a16110aabf740d0b103754e30b08fa659e3f01296

SHA512
1bbe12572e07cbef5584d227efbf5fcccbe741659dbf7201b8725309ff2eaa555ca318a022955be4b31781452e1c6f1b03f4e03abc158fe2d6a26d37402c87c2

Download Submit