ff0df113cde47b8696544f0101de484849dea51e18e66467f397ed4537e1f60f

Analysis

max time kernel
96s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ff0df113cde47b8696544f0101de484849dea51e18e66467f397ed4537e1f60fN.pdf
Size

2.5MB
MD5

cc1e7176e3ac23d61ae63726d77f30e0
SHA1

e4e1e195f610835cf1a59412b80126ef0cc28f89
SHA256

ff0df113cde47b8696544f0101de484849dea51e18e66467f397ed4537e1f60f
SHA512

0712cbb73b7e4553001dc2442d05e38c2e8f59ccb6d6916caff673585cc4c7ea267a9260c596a5f71cd96bc909263a7d4285a5543d7e2f94a4286ed9e19b21b6
SSDEEP

49152:MbyfYXqD1J/NZSr6PLJF0flJn1DZoLpXSqW9MDanNHE6d4:M2QcfSOFF0flLIlHWzdE6m

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1736	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1736	AcroRd32.exe
1736	AcroRd32.exe
1736	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ff0df113cde47b8696544f0101de484849dea51e18e66467f397ed4537e1f60fN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
026c856e9af0bf5f0b8c5dc31a93c899

SHA1
4004e6abfb727919f2972964b1df5e534cddba27

SHA256
e6fc88e79e03b7937401a92e99a08a3f78bdabe9d9e56f2efc3d5d5fe0c66c07

SHA512
6832a1d99b852aef257b04ac09d66175ce92487eccdcf4f5b5f34cbc6afe1f3719b94b165153e815003891000c2ec1745faa4107d5f4fdb1feb74d0fe9a162cc

Download Submit