3606c13047b0134677e661741c21539f3d40399bef21c977098dd53835792f41

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 07:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3606c13047b0134677e661741c21539f3d40399bef21c977098dd53835792f41N.pdf
Size

249KB
MD5

1a34ef9e1a7ed518f992795529f4d190
SHA1

6ffa237131cc2b064fc6bdddd0ab01d2c5577a26
SHA256

3606c13047b0134677e661741c21539f3d40399bef21c977098dd53835792f41
SHA512

6c813ac45786752e74032ef7f03c58c7b9810ed6e71e0ee4844721f0169f183148d78859b1b223014cfecc8b65a36ccf6c41bfe26d4428ac3b4f432c1a8185de
SSDEEP

3072:chtmjhPWnrdluROASDwdFD8ADvCm/wgUNSn7e8IztoQTSxKUGBitQsiVgXfuCsPq:cnm9PSYHScdnD6B74n7bp/KUjQsY+Cy/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2688	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2688	AcroRd32.exe
2688	AcroRd32.exe
2688	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3606c13047b0134677e661741c21539f3d40399bef21c977098dd53835792f41N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f01115e76e994fe7ca47625f91eb4aba

SHA1
d1ba6fd4f0908ade1ec5d12287ee0ee5ae7e9042

SHA256
763e9de03431dd06cf081aa6bbeac70ccdb7fd4f813f09ac64773a39320bd453

SHA512
144cb61537bd1406340632c83aadfc6c8f9c1a8335a6b70285120b0f930b646ec8adc558c58542ead8b3a5d53891c66cb487e0eaf142a0a8ac20e24c1064d46a

Download Submit