69cb64fd0575c0dbb97e26571c6a6e46ccc6f1249e6d8693878968c637358ecb

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69cb64fd0575c0dbb97e26571c6a6e46ccc6f1249e6d8693878968c637358ecbN.pdf
Size

55KB
MD5

dd9522c22de19375f024897c5c25a930
SHA1

73f9fcc666fcb71a30524b1fa79fcd165ef21e4a
SHA256

69cb64fd0575c0dbb97e26571c6a6e46ccc6f1249e6d8693878968c637358ecb
SHA512

8ebdfeb8250a5d6fd99a8ba07035d5aebd3fb5923239d78142253293a5b70d69b5617dc15883a4dae1412da311f9d5f993d1f04be12597d24ba9f4ea1097c7cb
SSDEEP

768:BuzdNIggou41dMV+foYlP13NPwZ6HZcCxm0XP7Pp65MFI9Rb:gzIW1dMV+foY56KvTRdFI9Rb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1924	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1924	AcroRd32.exe
1924	AcroRd32.exe
1924	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\69cb64fd0575c0dbb97e26571c6a6e46ccc6f1249e6d8693878968c637358ecbN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
257125a180bfb8a7499a3421bb7d39b0

SHA1
fb7367426d4cd25c023450c25619854cbb6bb056

SHA256
b090d49a83d09635ea44bdd5b382bdb23068e36e4b41e8f3344aab85b3f919b1

SHA512
074ede3b4adf51d20a7e916fd3cb35fe6ab204df9aa27c5261500433c3fc46b533a749c069a624bb33c8426c0b486ccafced7b67d780b041514269b7f2738354

Download Submit