2d53741d89fa2ed1167c93b393672fd57729873a7c230bc5221f9715ca6ee9b5

Analysis

max time kernel
95s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d53741d89fa2ed1167c93b393672fd57729873a7c230bc5221f9715ca6ee9b5N.pdf
Size

173KB
MD5

47d65d81c98140b771753e37fcfbfc60
SHA1

10a20c0baf5f7fd4f39e8fa286410e5a8aef332d
SHA256

2d53741d89fa2ed1167c93b393672fd57729873a7c230bc5221f9715ca6ee9b5
SHA512

d607bd69d250fd1a532630994ad7d3479d85d554ca2cddd53fa9d151150c5ce2549a28b8d739f46127475275be73e37667da4ffd3e0a93f0b44bdfee923323ff
SSDEEP

3072:6ZxgQjY51/+EzmpkytpNDIyJenHMeX56Y+XavjsdmB0+z/d5R6KWef5jKk:KY51/+nxNzesepV+KvYdmqsOlssk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2984	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2984	AcroRd32.exe
2984	AcroRd32.exe
2984	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2d53741d89fa2ed1167c93b393672fd57729873a7c230bc5221f9715ca6ee9b5N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
16b64d81885cd6c1aa662dd341456059

SHA1
0445a36f12db2c03492a1a912fe8cd92c9f28191

SHA256
68e7b9fc8e47320a122e8fe7b780b304b4497917134668ff3bb6d74298246497

SHA512
069a0286d66bcc5f67ebffe29d71c32f7bfda618d16ada78619fd07206afdda5e8d7dcca17f56f77ad874e54e626aedf8c50e11fed80e6b81df7cc7f00361c83

Download Submit