6bde83487b2fbf67a91579904ce5314b9c7bba6ee641fc88acc32943d37cb794

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/10/2024, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6bde83487b2fbf67a91579904ce5314b9c7bba6ee641fc88acc32943d37cb794N.pdf
Size

640KB
MD5

d3464c982794d72b816299c4d28fc040
SHA1

997a55671a5f568077db4db8e267df7e3e7ab59b
SHA256

6bde83487b2fbf67a91579904ce5314b9c7bba6ee641fc88acc32943d37cb794
SHA512

c1989c76c871171adfc641d43a801e7a188f03c42b01e4e78707e0375f9cee2e9a70aacd2d90f78ae8528f266e7721aa32980826a6ab91caa957cc8ecf2c46e2
SSDEEP

12288:5DSp9IFiSALhlLfuX6W5jlW5R2mFmufPyzsX1EmaRt8gs:52qiSIf/ilKRJtfP1BaP3s

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3024	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3024	AcroRd32.exe
3024	AcroRd32.exe
3024	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6bde83487b2fbf67a91579904ce5314b9c7bba6ee641fc88acc32943d37cb794N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e7a6712b531649a2afaa916440a7bc0f

SHA1
dc4cba8ec2c7d39eec127a1a024fca4fd58577f1

SHA256
82957a20f9ba1eaeacff8b2f0ee8cc473e2c1f121cc7cfce3e9c809c911b6e86

SHA512
478c931a6ba9ab043ab6570420112db16c7409ef88bbb97f156280d2f89123bff7b29f532421abbb6c99fff8b8ce2101a91d87043b339aa2d7b34248ab938c55

Download Submit