1e24b261ef5e50c56e0697e4c22019d9d909f6e2000b9e7ded4036681e1b59a0

Analysis

max time kernel
106s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e24b261ef5e50c56e0697e4c22019d9d909f6e2000b9e7ded4036681e1b59a0N.pdf
Size

1.6MB
MD5

dbe41d0f4f39233af82fe6832dec4ea0
SHA1

d97acdb561b5c747c6d3916ef3ab6b4cfb2a9882
SHA256

1e24b261ef5e50c56e0697e4c22019d9d909f6e2000b9e7ded4036681e1b59a0
SHA512

bc37e45e26414ef214ddfbd0bb69b1373a876d157b45738e69b5c36b1c5f8bb5fd11ffb3d224adf7ca147310d09a0b3560b9aa26ac0b9f89788744ea2b787f25
SSDEEP

49152:dguhgcrbQpAgUAbVGCCkh8nEAJRS1q6yW:6uuIMiFY5h8nBU3n

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2332	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2332	AcroRd32.exe
2332	AcroRd32.exe
2332	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1e24b261ef5e50c56e0697e4c22019d9d909f6e2000b9e7ded4036681e1b59a0N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
13a5a5f5d030dd1c38304bcae612b093

SHA1
043cffdfe0ecbb255c10e7816cf49036dabad208

SHA256
75cf57f2ce0b938094dc0e3abc9875716e8d729b2698b16a4dc22b80cc2a284c

SHA512
831a245f90f5076aafc4e96ccca367f948d8117b53064474da476739cb9660ce5a556d30ac7c8985f2477d2106071af9bb967240d8e9f8141cb171b2837eb3f6

Download Submit