fd5914c74ef07d7233828a843151919f7f5def9cc38df9155913d8090ccae9c2

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fd5914c74ef07d7233828a843151919f7f5def9cc38df9155913d8090ccae9c2N.pdf
Size

356KB
MD5

2ed0291670ef434412e11c766923c420
SHA1

12fe284ff9d4daca90d0cf6a7cbf2efba0550fa8
SHA256

fd5914c74ef07d7233828a843151919f7f5def9cc38df9155913d8090ccae9c2
SHA512

579782d1d303c824121f186ab507f91e991e53f8c922b6b4150a4c04da4d20690b79dea0eb8c13ced310df574e7ac6398ac90712e80274da302cecfa6674a89f
SSDEEP

6144:pBeZ0mjaMAOmho5nzD63+EqygX58ilU2X/7qcgzFOIjJGh5bHcBrb7m2ffmo7:pgZ0caMAAK3+Eqygp8iV/HgzoIjepHAH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2696	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2696	AcroRd32.exe
2696	AcroRd32.exe
2696	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fd5914c74ef07d7233828a843151919f7f5def9cc38df9155913d8090ccae9c2N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a4fa414a097c14dfb99c51cc025f1ab8

SHA1
748a87ef3174c78e31b608f662c7e97b4c96ff9f

SHA256
20289af6a402df82ea78ead610e619e347a9b7c5d5581e0e9f82f487131be7a0

SHA512
88a183177daa89e6643df091d9d1eef07ae75bdcc0116d2dcc925c982bb07d53b2380845458582c6dff5d079eef3e5c9a0f0121dc83ded922b26bc6422d62315

Download Submit