a1c1e6f4dc0fbe2f2d5ac950d9cc83c6f153bf52566e01111cb71296f0760d23

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1c1e6f4dc0fbe2f2d5ac950d9cc83c6f153bf52566e01111cb71296f0760d23N.pdf
Size

357KB
MD5

32ba337515bff996993c361fb6732d20
SHA1

6d853a0e86bef934d7801f3f45db67fe95333205
SHA256

a1c1e6f4dc0fbe2f2d5ac950d9cc83c6f153bf52566e01111cb71296f0760d23
SHA512

57cfc5dd8740887688c7df33236d973b5d3507dd0e6b3671dce4e33e771f4a9db2d9e4490fc21a9aa7ca74856535625f9ce40c4d002637693f556474b51e2689
SSDEEP

6144:aimLdM+Qtc9l84c8mGbaQ76FYYa8VmB3X9Z7oOjs7lcgu4//DboemckB:ail+Qtc9mh8m5QOFYYaIU3n8qg3bo1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1956	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1956	AcroRd32.exe
1956	AcroRd32.exe
1956	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a1c1e6f4dc0fbe2f2d5ac950d9cc83c6f153bf52566e01111cb71296f0760d23N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ad1c4454014afed4f38b33dd3413c9b6

SHA1
98bb7e358cd88982492f667fa5dcbfd1fe6f2120

SHA256
7b33d8108dc8b282f244041fd264874d09280655238473ec66954ed5e658552b

SHA512
f555c0f9ddd7fe1dfcf59b9b0e24310c16bf0d869b61c1e55fa0d45b1d6407406337ea01b8497f7a5441e05235d453272b5794f4ce53b64644cb521b1dbdd5c2

Download Submit