2d08236e2fdd0e3d72bb46ff7ec80ec2618e69fd4851d1d01f0b5b8a6e7201b7

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d08236e2fdd0e3d72bb46ff7ec80ec2618e69fd4851d1d01f0b5b8a6e7201b7N.pdf
Size

264KB
MD5

e6574cd0e93252b0d11f43fa4ffbd8a0
SHA1

127d19c6b992e1fc2603d6dc847597d8e55a2bb3
SHA256

2d08236e2fdd0e3d72bb46ff7ec80ec2618e69fd4851d1d01f0b5b8a6e7201b7
SHA512

bda7a755057a9dfbe793fd4aa209172513c4d62326f11c5d3b4cec3df0690772402abf4794f9d48e7acc378013c18c47db65152da90aa7cb253ec519cc0f451d
SSDEEP

6144:mJttXkx+saaitCQx/QRXULG09NxF4D4lphLR6POtJKKm1:qeaaitCi/QXKxF04l/LptJ+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2492	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2492	AcroRd32.exe
2492	AcroRd32.exe
2492	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2d08236e2fdd0e3d72bb46ff7ec80ec2618e69fd4851d1d01f0b5b8a6e7201b7N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
efca47efb2683950ad0316cdc46752c6

SHA1
0ec43abeab409a587036239238797ca3e0b7ab96

SHA256
28e7da88f004bf702f9ae38a017530b3dc95228e55641360b054f647775dbe94

SHA512
286a6ae267e1931cabeb90a7f52fcb44143821d5b92c3cbc00009b34fe2de93f95573a0fc76f947e4bb198e0b068b79a6b53bedc3d2f61a70c223037d34c1c1b

Download Submit