30263649fa9032042bd4f1828fd41e6dc096be790c60c886741b4ae0fb86bd22

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
26-10-2024 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Data/Documentation/OLD USER GUIDE (1.1.5).pdf
Size

521KB
MD5

cc99b10d3e676e70bb31423c2df1798b
SHA1

0d151451d16631e1deb684287da54aab88e85560
SHA256

1fc2c2afcd18d7510ee4e65bf9b0180826dabab613cba1dbb798348a88d47f5d
SHA512

9211537b31aa3c000060d82b524b2c3589d4cd5468a3b3bcb084743ac1e24761ef1edc0a136c5962668bf657973b136e2d222d9ae387efa3b4751b040b1dbda8
SSDEEP

12288:hov8MKgQBXDijBCPbIzXVl9UoxojPqiGGoynTJ9A2nQ:hov8MKCjcPbILP9Uoxoj7IyXAX

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3052	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3052	AcroRd32.exe
3052	AcroRd32.exe
3052	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Data\Documentation\OLD USER GUIDE (1.1.5).pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d2fdac36de2aa72936cd3fb1f0de7902

SHA1
f91f50c78f6eeafcb93c4881dce3cd681dd680e9

SHA256
6290a08f74b8a14b0637a7ddd356aa3c701fc9e1d7c46a2474226380c2e15fd5

SHA512
cf7d89b45472575bbf5c79f81df9430cd9a6b9a0e49befc91adc60d8e5e598792dbfa66d5ca750f5858e1973787a082dc3c8995c2f8fec286174e5f80daaae93

Download Submit