c428dcba884a40e23d014b5f8853abbbedec3a52eda27fe968d3e269d99950d2

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c428dcba884a40e23d014b5f8853abbbedec3a52eda27fe968d3e269d99950d2N.pdf
Size

160KB
MD5

f6ee5f08c7891c7ec598701f6aa527c0
SHA1

f3fce1332656cddc92967d70ae850daf82576622
SHA256

c428dcba884a40e23d014b5f8853abbbedec3a52eda27fe968d3e269d99950d2
SHA512

fb322becbb230a35581343f1eaa80ef3ceb2ff7281772f75df631dd33a197cd9a8efe9d959049979717cb6d7bd205b43d8e7a69457d528978f2eebed2594b1b2
SSDEEP

3072:Z3wb3c7yLbx8R/olCjuN3V9D+L/jKUL4WacAPBkww:2Lc7NCWuN3V9ILKAKq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2336	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2336	AcroRd32.exe
2336	AcroRd32.exe
2336	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c428dcba884a40e23d014b5f8853abbbedec3a52eda27fe968d3e269d99950d2N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
86a3ee8e7099d0a06c1262b62763fb7b

SHA1
45992ff9079a211c8973950d874ef903118a2fba

SHA256
115b267d87db1c66b60a9df8cb24d8085a6794f26f862059ad5091f6ced61291

SHA512
1542c37469eee4e9322dbd5022f7067dd9a417bbf3fd17033222653fe7c3e23bc0464d21a8f8eb7e6365c25d6bc3439d05792f863235dd3d15e9ae774b83deeb

Download Submit