efd56508b9bd92a9a36ab1b9059ed85b56743945253d988435d3c21afd6901a7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

efd56508b9bd92a9a36ab1b9059ed85b56743945253d988435d3c21afd6901a7N.pdf
Size

434KB
MD5

88b4a782882b468b203c77fbb679b220
SHA1

4eec68cdd6cc6f4c760a18b5985773220f19445c
SHA256

efd56508b9bd92a9a36ab1b9059ed85b56743945253d988435d3c21afd6901a7
SHA512

ec90cbb5be57db595151316df17f095694847ca340ce08535da7ed7207ae39d37b1c6521154171dac359f9ab5c2f15581bbb5d7f25a23ac7dba8eec946b7b35c
SSDEEP

12288:Cpn43nt89ALckIT1sn09ub/z5WgSNDqMMp4dL:Cpn4XuSokHn8ESN2H8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2256	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2256	AcroRd32.exe
2256	AcroRd32.exe
2256	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\efd56508b9bd92a9a36ab1b9059ed85b56743945253d988435d3c21afd6901a7N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2449cd2a57abe0f1b2cdf3b980ae0bd8

SHA1
4ef97d4464b95a29e6b636c73fe6835c9b67ae18

SHA256
25af36a301b7b268422a6ce36d7bba2963d32829faa25c28dcdaff3ccb42d2db

SHA512
546b9ab3bc80f43393c81bb0a469922eedd1c05fbea95878eeaad96cf6b828912609d580923014edaf389a952c57dbf9a7a9bd1523d29c7ae0556794ceae67bd

Download Submit