3855fce4c2b0c3245a36a6e494cf1e05fdd2b48e7bd9b0d779bba7283e2c5390

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3855fce4c2b0c3245a36a6e494cf1e05fdd2b48e7bd9b0d779bba7283e2c5390N.pdf
Size

302KB
MD5

7fc2ca8bf0234379a3f91ca37c2223d0
SHA1

8622e12609885e94e229124bfbe85f11d68cfad5
SHA256

3855fce4c2b0c3245a36a6e494cf1e05fdd2b48e7bd9b0d779bba7283e2c5390
SHA512

fc768dfd574ff71de5925b7c4b3f0e71895fb7f8b011b3ed14836ae23b0c509d35a4c81e6d7fcd1a1e2f41c6e6d002385ec254c62325c4e3885bf7a5731ecf92
SSDEEP

6144:5urMToVKJZXPWBpx/Z05qirKzjR6abNDD6PK46PIs19GZfIvR3RM8mA2sXLEn3c4:5urMsaOpxB8qi6jR6kxOPK//MgvZJ2so

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2792	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2792	AcroRd32.exe
2792	AcroRd32.exe
2792	AcroRd32.exe
2792	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3855fce4c2b0c3245a36a6e494cf1e05fdd2b48e7bd9b0d779bba7283e2c5390N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
abc8ccf20bf5f445ff556dad5cfb07a5

SHA1
084e16f5e8ebc14feda7d69410949d51706eb953

SHA256
d9e954a7c7a0bed1b0929c9c359561a2f3ada92a6f86dd4c3e0cc8022687c6a7

SHA512
29090d1194bb6a30255f65bf582c105a143dd4547766a295cfe3feb0ea721d9234d73f24f3b3a58177386f2987f7c3d279fe5582b5dfb8a15bc2427eb34efa58

Download Submit