c1a14878e99f659f690ee82216640fdc826bd80e6e26cf6a76a29176b0904ae1

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

001.DemadaYAnexos.pdf
Size

51.3MB
MD5

9b6fbc17307fb7f3492fddb994b657bb
SHA1

8859ff76f105b7e4f36ef3ab6f8c68376f291698
SHA256

b5a3b56fe2c080201e277d18216b08486ab27ed84cd8c1adab051c6b88aaa6c5
SHA512

e01fe1a2ca80f7aa6b459740b53f47adb48f286805aae848db18d1a891092cb659df7aed6d69197784a96f11a35aab1e251c180aaaa52b2579549ab14e140311
SSDEEP

1572864:6sqI1GbTL2ikbTL2idsqI1JsqI1IbTL2ie:tqIeL2i+L2i2qIUqIoL2ie

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2728 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2728 AcroRd32.exe
2728 AcroRd32.exe
2728 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2728	AcroRd32.exe

pid	process
2728	AcroRd32.exe
2728	AcroRd32.exe
2728	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\001.DemadaYAnexos.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d66a86c8f944264e27ff24dcd06db737

SHA1
a0bc823fda294b284a2e138f46e46b6435e5e44f

SHA256
d3d72ad93524aa291deaef06be0bde79b5fe8d874529a35c80bcef8782844b2a

SHA512
8b44922bd983bda5f497302e5f0ea06415a056fb92add1f5be3b0b790e5fcb7d8ca82d93713cf92d310e619baf32b75c636ed8d7cb3622487bd0adadb0164faf

Download Submit