53e797b5c5b62ace3c9f16aa3d517a64e6544c8729ebc6bfcdffd9e308bc9af2

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53e797b5c5b62ace3c9f16aa3d517a64e6544c8729ebc6bfcdffd9e308bc9af2.pdf
Size

411KB
MD5

3c25997de9d62cc79c6a0e20a00559d5
SHA1

60477c20de85c98948f6bb0145b78da28abf34e5
SHA256

53e797b5c5b62ace3c9f16aa3d517a64e6544c8729ebc6bfcdffd9e308bc9af2
SHA512

7c03504a138b34e4b34bb9d6fedb9578338294273ad45a2e456aaab76900c3c90bf3ec176ee07b3cce2c2a99219c8a4f1fa7263104c98fca6af2b0a7399b4439
SSDEEP

6144:vNv3O6liEvq7J8nsWUGVTGrP+gQycPQQFEs8Eq7nBtkjvtPF:vNvriECNYAWPQQFElEQtkxd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2252	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2252	AcroRd32.exe
2252	AcroRd32.exe
2252	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\53e797b5c5b62ace3c9f16aa3d517a64e6544c8729ebc6bfcdffd9e308bc9af2.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bd6e7d30be3024fb8d2e9e54b11654ac

SHA1
3a970a59db6fb6cecbb2080d85a38675629a2ebf

SHA256
0a6050c061c2e8e6a4a481c18812f7c48728b39642eaa3d4fcabb9fd1b31f241

SHA512
e13f7368df64c7f6714c657675223c506b838e45dbbba6397408e2c9fcc10152532eefdd0408864baccdbe27871f98e832992949ee86ccc1034f046131d5c2a0

Download Submit