6ed04c0692c49a8cad16d8ab4f37da271b6fc9d93b31af4476d18200296b8c49

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ed04c0692c49a8cad16d8ab4f37da271b6fc9d93b31af4476d18200296b8c49N.pdf
Size

59KB
MD5

8de8d36011acd3e335294b1c16239460
SHA1

13f945e019272f2c62b6440cea81595efc2c28a4
SHA256

6ed04c0692c49a8cad16d8ab4f37da271b6fc9d93b31af4476d18200296b8c49
SHA512

8d975a13f229782544969c81b92922fb71b600bc05372159c0e1ca86e55bbe9dbd11850b5daf81287e6068cc7ee4f2bbe1a7f6abfcd691b36371ff82db9a8fb1
SSDEEP

1536:ozIW1dMV+foY5VDB1xDV23larQLoExp3LC/m:RWHMkXB11V+M5ETC/m

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2516	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2516	AcroRd32.exe
2516	AcroRd32.exe
2516	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6ed04c0692c49a8cad16d8ab4f37da271b6fc9d93b31af4476d18200296b8c49N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a53e0dc2393d757739ac7fad79df6db9

SHA1
a8bcb069644d7c36e506ca9fb6c1cb8b3edf86c2

SHA256
d910ae12543dd1c8024e4700254a25f8c9385b059e10dad7433515d3cdb43056

SHA512
d08303b99a271fd318c4fb8bd78ebc4fdf425c8152593584d38090c0f5d564ab40fcf41deb6484d0dcbf91b944eb4327fca509546321ee8f0af953b6bd7799f6

Download Submit