6c2b94b6b4dd897c3f1f3eff836e83862eb7865379a5b76c6b8b15f17256830e

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/11/2024, 23:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c2b94b6b4dd897c3f1f3eff836e83862eb7865379a5b76c6b8b15f17256830eN.pdf
Size 774KB
Sample241109-3j8testmgx
SHA256 6c2b94b6b4dd897c3f1f3eff836e83862eb7865379a5b76c6b8b15f17256830e
MD5 63e0bd1943df0032b33d9e5f83f63d90
SHA1 873840be18078b7ac701816667e57ffe68d21ea4
SHA512 299f60a7fac7804399efb0b335800e44c7b1597110ad85635b782a2929080b02d1f7bb07209340f24c1cc3c4882fa9456602b8a580ca7fa3d3803e2b61b66682
SSDEEP 24576:aKWPWBK4sXFODR5phBlJkn5r8yXTtfGhR/:aKQ4KHmRrhwr8yXhfGn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2416	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2416	AcroRd32.exe
2416	AcroRd32.exe
2416	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6c2b94b6b4dd897c3f1f3eff836e83862eb7865379a5b76c6b8b15f17256830eN.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 996696f10cb60b7f6ad0713acf147692305af41e4dc262964d9c0458549105d7
MD5 6d70d7a8c16f0d9d4c7d923b10ca811f
SHA1 f6e7343eba8278e6b59456e8f634979bf6cccddb
SHA512 34e2c499f3537766e4eb0ba99cf03c80bd5032c8fc7eb30849696d7b5ef045c715da172d4b18fed1c1fd83f1ace8c2f909c21e092fd2c4c75bba3972f39cec19
MD5 SHA1 SHA512

Submit Download