140f546146a2404b173e42a8aad2b01c602d1c433956f1cf597353d63542fe30

Analysis

max time kernel
97s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

140f546146a2404b173e42a8aad2b01c602d1c433956f1cf597353d63542fe30N.pdf
Size

301KB
MD5

acf11160c1557252f5b7bfeed0dc59e0
SHA1

aad88a85b64362ee98f82630cb3f48bf3d3117f0
SHA256

140f546146a2404b173e42a8aad2b01c602d1c433956f1cf597353d63542fe30
SHA512

847568be6b4e5e8a7036195e8a7f5af8addd9fe5ed0b9e75fb50a52550dccecd3188c753abd36c124c2e12e053cb01716abda9de70d034bb4ab4ce3ad5a1b636
SSDEEP

6144:o2HKeoBb3QNmD1elqCF30Bd0dNCjbcl68V5FHwBUrRpVZxGxbluK4Iu:oIKFp3Q21elqe30BdkA3c0eNwByRzYl2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
572	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
572	AcroRd32.exe
572	AcroRd32.exe
572	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\140f546146a2404b173e42a8aad2b01c602d1c433956f1cf597353d63542fe30N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9fe8f6626503aad05ae1a90907b67c13

SHA1
0b1f624dc843f74f9fe9265a513acd9ba57d84ca

SHA256
f9cd6ba13c9587396feecfa41ae459a19725c76224dfb824156447ec320d6613

SHA512
bb46cb1fdce04340f88ec7d54bcd808efec7a1b41ba86b455baf2aeadbfcb3525f85e3e2eb5b836734a41100b3de422b2b1236f41ed2f7ce3105431612222e8b

Download Submit