0ef4867f128468591782802663f6b6f49e404bc9949ce54fe385837565ca2efe

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-11-2024 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1099Misc233.pdf
Size

220.0MB
MD5

daa153b1d4f8ecab0d0cab2911b89ce7
SHA1

26eabfb2506d2a89c97ac1b4e19bac67493cf009
SHA256

dcf81f648ee6d097226d3c885561c34bb22e738501e410410afce9787bd43009
SHA512

016cda97b65730cc380d4120ce65d70cb0bb079b8c869d977887c53dc29276bc7949d9f7793750241551c3299c697ee1f643406d1cd5cb07132b42486f98b3da
SSDEEP

3145728:k6lH+byk0ZggBznCh2HCea5bQ92NmDVr9XqnZGWp:

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2012	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2012	AcroRd32.exe
2012	AcroRd32.exe
2012	AcroRd32.exe
2012	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1099Misc233.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
adcf47bb476b032af52a7b1b60af9585

SHA1
be279e2fb889834aeaa4ee12f4d18adc5df90431

SHA256
1ce2b511895da0cc0638e4beae3b0cd72bdd5a825942e63502e77f5b9bcdae7b

SHA512
a88e3a675f5c55ccd2905db2553c4fcf7e115c529ae4358a350aeda75f444bdf23fba9c16c492e1f225b21de8fcc83ff1a63bc470d5c177613d0811ddc80dd2b

Download Submit