8b93378d3c179ec3313d6b7ce7ae20983055949d091effc124624488f481b2bc

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b93378d3c179ec3313d6b7ce7ae20983055949d091effc124624488f481b2bcN.pdf
Size

59KB
MD5

1456ee860090a8b8d71263f6c0dc3540
SHA1

ee3a8b4111476407f23ffe42d62c8bd47e2550dc
SHA256

8b93378d3c179ec3313d6b7ce7ae20983055949d091effc124624488f481b2bc
SHA512

3ca5929bd81ea4f891ef9a600d61705e1da0c19c857d65cb88728c019f836956419a962ac92587c7d15ec51c5dd1f36f2a76a52fa7e4761e9fae5a9ef7b95b13
SSDEEP

768:CuzdNIggou41dMV+foYlP13KEOkuOQrmwfkhIS4yh0PamUnqy8Az36y:9zIW1dMV+foY5bOkuOUkj4NamUnmAzKy

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2348	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2348	AcroRd32.exe
2348	AcroRd32.exe
2348	AcroRd32.exe
2348	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8b93378d3c179ec3313d6b7ce7ae20983055949d091effc124624488f481b2bcN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d0ef72b5a522c60a8f6f2980b0bc9047

SHA1
0377d43b4edd0557587b540506a075c1a9038653

SHA256
4f8460c1c1d834bc3468b7eb4435b1585d5572d6b307f95d1c8858f73b8af1cf

SHA512
525e82bfc4b9c0d04a1ef1086360b07a87de51dad0d4213fdebfa336a29e96d055b192620e6fec306c5ef9ddb3b6dd83aff7b472e7932cd601f26a2441c51061

Download Submit