00f7272a81ada159d583b074dd7ab19ee762ca410eda5222bd4cb987611bdbb9

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00f7272a81ada159d583b074dd7ab19ee762ca410eda5222bd4cb987611bdbb9N.pdf
Size

223KB
MD5

d0c15124e48a6fc33ecd83c89ed9f340
SHA1

a3ebbec4869dd4421db7f3572075243b2e3b6aef
SHA256

00f7272a81ada159d583b074dd7ab19ee762ca410eda5222bd4cb987611bdbb9
SHA512

69eb40cb97568e778bbfc15704880c4559da1f94e6bae12e76cb3aa2848f7a4d06eab54bf626909fc61e3536a8874a96bfb729a8d637f8ebe2d7ef77f0a70daa
SSDEEP

6144:lVmHohzR6SBW76RlTpVNFgYT9Zi/JDCQZ3tl+n1:lVmIv6SBW2Rl1V3NTniBXZdlu1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1760 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1760 AcroRd32.exe
1760 AcroRd32.exe
1760 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
1760	AcroRd32.exe

pid	process
1760	AcroRd32.exe
1760	AcroRd32.exe
1760	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\00f7272a81ada159d583b074dd7ab19ee762ca410eda5222bd4cb987611bdbb9N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
620495d6b0ffeae38ef2dad63aa425b6

SHA1
5ee473e6cf315ec85efa581da1b50b1e1b133c8a

SHA256
ad0cf02ab2ac06f57ac61122b268654153c7d38342d7e9eb825b839704024df3

SHA512
59d48fa7a3c6bf5bc83e0262ac102b32c9412838e566e72c6af1e36eeadb181c3af8387ca821cdaa43128ced7553df3fff75680bd8fadb5e04175e0948c4e4a6

Download Submit