1dd048ecc121e31ad8213b6095d7ba33e76b2959a5d2bf930cadb00500850fde

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1dd048ecc121e31ad8213b6095d7ba33e76b2959a5d2bf930cadb00500850fdeN.pdf
Size

3.4MB
MD5

7e667a20a6fc4602ec40586c57222a80
SHA1

8e1ddebdc7609924fc55cfd47a578ab825f79ca9
SHA256

1dd048ecc121e31ad8213b6095d7ba33e76b2959a5d2bf930cadb00500850fde
SHA512

e097290721655dc278339e19512d55de02a286aaba945abffa66fa53acb7eadf5ef536096d5f63be809a0fc3c712e5547ce25d7e78c53d6067a72ead22cfac1c
SSDEEP

49152:nUb8gMPCLnLCthFdUJ4MGiGOam4GSNV1lM0HpC7+/b+IBjYXEaGSTjVDw2Rnk3R8:5glYI4MGiWwBFlSWpd9sKd/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2908	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2908	AcroRd32.exe
2908	AcroRd32.exe
2908	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1dd048ecc121e31ad8213b6095d7ba33e76b2959a5d2bf930cadb00500850fdeN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ab8509e1dfa16102c43c39bf981430bb

SHA1
2f8309e7aeeaba80bcc187af3e4dc506ec2c851b

SHA256
d124a8dc4ed5c3038787d42c3febc6824d6c28719ef3d5c07c31e61ed146f6c4

SHA512
a63d30f93c502e084a4ef03aefdb05434d55456fb541ac3816a6ac56ff3a4af532d576164809bf13778b3df0905e97e72d99d1326426bf29d2d544e272140dac

Download Submit