662e88545c39be810ac3e9e48be0b7a78b7ddd67064505f9beb9aeda5b65f6ed

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

662e88545c39be810ac3e9e48be0b7a78b7ddd67064505f9beb9aeda5b65f6ed.pdf
Size

101KB
MD5

0c485ecc9b90d6f24833ebb843b2f659
SHA1

c69d45da29ddfc2d7975612fefd99c1f91c895da
SHA256

662e88545c39be810ac3e9e48be0b7a78b7ddd67064505f9beb9aeda5b65f6ed
SHA512

f0dc143036e46d906fb3bb0eba27ec2f846a168c656d4061e87fe435a26adbdfee9af948d23829b172a7821f482e9ca5779ab527242343eece6b90d2fae6d3fd
SSDEEP

3072:vqA3uXGX3KXr9QTV9E74d7rtbXAZqWq3TaS:0XE3KXq9E74YkDaS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1976 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1976 AcroRd32.exe
1976 AcroRd32.exe
1976 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
1976	AcroRd32.exe

pid	process
1976	AcroRd32.exe
1976	AcroRd32.exe
1976	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\662e88545c39be810ac3e9e48be0b7a78b7ddd67064505f9beb9aeda5b65f6ed.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
946a993abaeea55b51657fc41da7304e

SHA1
267f8bea3a819f839d9966499beccc0327e6aeb4

SHA256
95082455660b8717e83a426b4762f27508b879c64d7d0846a8ba101a5d61dc79

SHA512
4b39cfed6fc0ed1b6c209158cae33f24d381213f9223871d85193248bfc683bee4e416195fefe865079d4da70f8989521a7e186ee8dca8d80a2da70dadb0b8fa

Download Submit