47b6b37b5079a45cfc861275c49a1556e070eff4158a73cec6258493238f32fa

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-10-2024 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47b6b37b5079a45cfc861275c49a1556e070eff4158a73cec6258493238f32faN.pdf
Size

60KB
MD5

ada41c904e87dafac35d960ed85de390
SHA1

fbbc114050ba54f988846e5f5c989bdb6163ad15
SHA256

47b6b37b5079a45cfc861275c49a1556e070eff4158a73cec6258493238f32fa
SHA512

7e7a6af402d62fc9d63779ed6561432a1bcd199cf461d37d59069c6071690f0a7cb122aec9d6a9f3e0301f952b4d242542768babe9a34a6839474f993f937a3a
SSDEEP

1536:wzIW1dMV+foY5sGV1jJpk85ePxDUNwd4pb:5WHMkt1jJuQSDUnpb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2676	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\47b6b37b5079a45cfc861275c49a1556e070eff4158a73cec6258493238f32faN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e2a36fe9a82f0b74d6be6a29a03f4085

SHA1
db0d879fec26fb2985b0225851a43a55f6b55395

SHA256
11e7caf23ff990948cecbec8bb632f5b4e1048b5d9c528eacb3aeac8de2d4559

SHA512
cbb95b0cf1ca07e3ca87efef07dd2781e7a4fe7db3101d6df7ec571af133773366527c9fc757ad214ace951509cccc74e1bb74b5fd3d0d37f99af4e7da07ee46

Download Submit