8b2b7cde5827a9c59dbf62a73d73df4fab96f5d2198c12b3d3656b624d8ec989

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b2b7cde5827a9c59dbf62a73d73df4fab96f5d2198c12b3d3656b624d8ec989N.pdf
Size

91KB
MD5

3d0f57f899588617c96122105a197a80
SHA1

5f89b3c0c83aa5152d3528568f23a7c331a61307
SHA256

8b2b7cde5827a9c59dbf62a73d73df4fab96f5d2198c12b3d3656b624d8ec989
SHA512

4f45babee4796e6689e1515b7de05f363f3eda88537a310e305058679c7f6d8b312fac03f914de2c8e9db6e0a4fddf6600f369985b508614deea3a2b5fad06e2
SSDEEP

1536:jMkesEkcElU6XUmqvUbPvNisPHsmNsauzF1Qg3:ilElLXEvKvxHMFh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2256	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2256	AcroRd32.exe
2256	AcroRd32.exe
2256	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8b2b7cde5827a9c59dbf62a73d73df4fab96f5d2198c12b3d3656b624d8ec989N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bfecdcceae5c3da214f53205cbfc91b8

SHA1
41e2ba707f4519f904d47b81225928e24af92ab9

SHA256
145915cc93c926679e8762b94f9ea59e28b7783642230e0cb10c141caebcee05

SHA512
d7f3683a23994b5d86f20a17a0657b9dd375b9d507463099321635f664503498e79e3647aa141bcd5ad9c50032e29b942c77f4b3f486acce1f87e8aa35a49b9f

Download Submit