9b47edb0ca4737c689c8621c6c51f8b2a63a8f3c08eba791d3a5356fa9539dc4

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b47edb0ca4737c689c8621c6c51f8b2a63a8f3c08eba791d3a5356fa9539dc4N.pdf
Size

61KB
MD5

175bef9e3f82b8075b754465b68e42d0
SHA1

c4b573faa6aae8c5daf2b60dabbbdc2c276693a8
SHA256

9b47edb0ca4737c689c8621c6c51f8b2a63a8f3c08eba791d3a5356fa9539dc4
SHA512

b60325e83aa8a10186685163b6f16b3860fe7fafa775c26c8034043e36b2b2f532d5a34c4275130b21df610e6fb7a83af0133fabfa514fde7796c9db9d2d64f6
SSDEEP

768:YuzdNIggou41dMV+foYlP13PJ8MzPvCCdOfUQo2VSwELFSNQ2d3H/CPoS267:DzIW1dMV+foY5dJpFELo6dqh3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2792	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2792	AcroRd32.exe
2792	AcroRd32.exe
2792	AcroRd32.exe
2792	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\9b47edb0ca4737c689c8621c6c51f8b2a63a8f3c08eba791d3a5356fa9539dc4N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
aa14d1794694f844cacdfa774576f817

SHA1
e5d4b82e15934bec2d609a3f006ab21277c0ac4c

SHA256
949b69471d0db6e69fbd4a8ec9e5f5abd6eadaf179edd6b59fc291d8d38f8d07

SHA512
48452631a15de7c15936f808bb5cb1d84f7c0f2a28ef08741adfdbc611f173b5806db6b68deba5634c25467c215e8774b134042f2d313316f7c76af4d67eb09a

Download Submit