a30befe135ec24f1d5d8a7de714cbac1517462f9cbf1712786f0dad8641de0f9

Analysis

max time kernel
95s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a30befe135ec24f1d5d8a7de714cbac1517462f9cbf1712786f0dad8641de0f9N.pdf
Size

147KB
MD5

78280df73b236a70124577d7d65de7c0
SHA1

ea8da49b83579e13d5ef43ffeb0ac5a0fb247354
SHA256

a30befe135ec24f1d5d8a7de714cbac1517462f9cbf1712786f0dad8641de0f9
SHA512

bb4ff7505e1a575d11413f493aab15eabe5805e77ec7830943604c13c9dcd6186befa070065761a51476087f9dcaf26fb4e2985eea184f78b05a08045da22176
SSDEEP

3072:KCr1jven+aXrFHIv6ZlebVW173eUT8I3M8sfUW0Y0Wu6u:CbaUESSw8++cs0l6u

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2536	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2536	AcroRd32.exe
2536	AcroRd32.exe
2536	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a30befe135ec24f1d5d8a7de714cbac1517462f9cbf1712786f0dad8641de0f9N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2b89dacf35b1787e1e4c2709650f0adf

SHA1
8e844efbb70fb6136a22b70989f85239c25db0e3

SHA256
dc783ff489926e0213264db92bb59efb3943133f6eb6b5d95cda1c474be45de2

SHA512
10c97dc3561bb127cdb9fb7761c20b5a1c160813314ff0e2a26804b7441f07c5a24d4a2f1ae0859a2ebab0b19d3e854b7f3a74ef4dd052bd4180f1d625db0c54

Download Submit