c69f688378717b6c77ae3cec45b60050888d05ed730fe1131d35ed9a98fd7cb0

Analysis

max time kernel
105s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 07:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c69f688378717b6c77ae3cec45b60050888d05ed730fe1131d35ed9a98fd7cb0N.pdf
Size

59KB
MD5

70526eec7560c3ebbf43d05d3ed988d0
SHA1

5ba1b2bab602fefa73c05048e47f4b5e99974ba5
SHA256

c69f688378717b6c77ae3cec45b60050888d05ed730fe1131d35ed9a98fd7cb0
SHA512

9fa1e8450b52dd89c2c3b7f5ff1aa4f95db2096bdaa79492123b96574b66fd235643cfe4ca33c0290867e88ba8b9ff494cd14bfaf0412707ecd0ea6afa2af661
SSDEEP

768:JuzdNIggou41dMV+foYlP13Y7kOwNz15c8etbG16LmvyN6MTWtqm6KCHI:IzIW1dMV+foY5e2c8mbG16z6Ek6ho

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2380	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2380	AcroRd32.exe
2380	AcroRd32.exe
2380	AcroRd32.exe
2380	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c69f688378717b6c77ae3cec45b60050888d05ed730fe1131d35ed9a98fd7cb0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f9e3f73d4ab22d352ec708415dd48b38

SHA1
c7b0ab1783bfa7314abcd25cb8ecc763951bce27

SHA256
0113bd9fea2c2d2b279688c68ff2151fbefface46658eae3aa13bbe403da0d74

SHA512
508ab46b73a8d6fdf5bd1d60d9eb44d390caad1daf1a176548afa652a7fffebbf4e098f4181d0293f3e9188cdfee64851fcf28df06f8df8a4c877b985ff31406

Download Submit