2a96ade2eaf074687317e834a536f0313a58421e0363b6abc08b21345b7257a1

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2a96ade2eaf074687317e834a536f0313a58421e0363b6abc08b21345b7257a1N.pdf
Size

281KB
MD5

2c8208079e767d6ace9f32454905d8c0
SHA1

6527dde2cb4d8d68bf50c3e4047ca53463b77bc7
SHA256

2a96ade2eaf074687317e834a536f0313a58421e0363b6abc08b21345b7257a1
SHA512

088e44d2f6327a4cf9c489db8707af9d19e5a3b438e167eabc7afc9dc5789f613fbf8e5d236e0edb1577756dc8e520963220e44eec6669a7f83b88693ef5fd94
SSDEEP

6144:a6aII2YrG2MCx4ZmyDy0LrtN+vJkWIrFCwUMCtr4ikPBwJWZ:avRMCx4wgy0LrtNIClZCwUBtr4iqSUZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2068	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2068	AcroRd32.exe
2068	AcroRd32.exe
2068	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2a96ade2eaf074687317e834a536f0313a58421e0363b6abc08b21345b7257a1N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0b77d0b0798cbb8b06c9472670f00aa6

SHA1
f7b0ecd591bbbcf40913cf3837b344379657617a

SHA256
695a5971f133f63e9feed9bdcb09d190a3949cc6fa9ee269221d40b4faad404d

SHA512
20aa696e25d5b41e493b59e604887cd294ca6d5943ab9a3e99e75866105693154ebc35f96400eaf850ecb09173c0a508c205f3c2aa7ab7449c74f55a634a6253

Download Submit