37daacf3e4dfc49d9bb05ba378d652afff9759686c3e4b9c604bb440737ed24b

Analysis

max time kernel
90s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37daacf3e4dfc49d9bb05ba378d652afff9759686c3e4b9c604bb440737ed24bN.pdf
Size

170KB
MD5

caec8b7f131fb333c4bf81201eac6820
SHA1

0ea94ae0b4ed3e707cffc3d13e5b33a2a24f46e0
SHA256

37daacf3e4dfc49d9bb05ba378d652afff9759686c3e4b9c604bb440737ed24b
SHA512

a81ff48fc7ce1964b1dbc149016a58a76cb4cf52dbd8c167e24c03fc3d37d9e60a4ed8ff0705e9736517d616f488074d9b33de875b341cfe52e79aee8ddade10
SSDEEP

3072:p5xV+FvTKjuyMzhN0wMLS/RCYy+O1PAGdpxKsISS1BuzSqJSxanj5YoUva:VEpma/TMOhOG9sTogg+p

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2096	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2096	AcroRd32.exe
2096	AcroRd32.exe
2096	AcroRd32.exe
2096	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\37daacf3e4dfc49d9bb05ba378d652afff9759686c3e4b9c604bb440737ed24bN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
be841e075023a4bfd2dbadb06e962ae5

SHA1
ce04091fb1ba9141a5acac8c45ed70fda038ea4a

SHA256
0cb70f390dd455425323e6ae0745a41821cca2c014af571bfb87f18b336a8454

SHA512
0b4efb2a47a1ba9404aaaa599a3c69b4f916baeeb47d6d3fbae7555baff50c594c231cc382a59d4126d54f5f94970347c8496a5340d697964fa04db486fee6e0

Download Submit