c024c295aa6a232c52ad818eef67b34f973fa3553bf66671aea2876d90be36f7

Analysis

max time kernel
96s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c024c295aa6a232c52ad818eef67b34f973fa3553bf66671aea2876d90be36f7N.pdf
Size

285KB
MD5

34f7d1c4577e8f713465fef051d6f4a0
SHA1

f94766e832b3abe59222da0a177867d557e6111a
SHA256

c024c295aa6a232c52ad818eef67b34f973fa3553bf66671aea2876d90be36f7
SHA512

e8566a3e65406c785cf722582dbe57ac174a77357c05129aad33c6dcc697e98450495140cbb5f9bda57a12b5f8ed3a0a5936576a0eae824ade12ad6c9c57b920
SSDEEP

6144:Eup6CjDbdvYYCgEmcWNJYmzITrxT+fxl3hffMEUM:ACPbduglIN2xztUM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2248	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2248	AcroRd32.exe
2248	AcroRd32.exe
2248	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c024c295aa6a232c52ad818eef67b34f973fa3553bf66671aea2876d90be36f7N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7ec2e95bd89f05449cac9f0cf74823c7

SHA1
40a62105d9a4775fda63fde7c74761f83e926c30

SHA256
a42503efa348dbe32cc39f1a7787f0bde44a51395f377bd2016f5bc649190f69

SHA512
23fbf5b1e9f14013adff8a438bd4215b86797d391bb924e50b1563e8457550ae8d4cc36953bad192f5f6df661821de0e64c0d1f1b2e0f8549c95cdb1cbad922d

Download Submit