7fab976ec142611835203959c2c890e8a8c58603592d3300820ffc54113f8412

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fab976ec142611835203959c2c890e8a8c58603592d3300820ffc54113f8412.pdf
Size

96KB
MD5

a90394fb82ae99844b5d1e607bb85408
SHA1

8cebeef6494d6fa7afc66ba950cb2594832f1866
SHA256

7fab976ec142611835203959c2c890e8a8c58603592d3300820ffc54113f8412
SHA512

039ce18dfe612595f0aebe3ddefb4e2de621a8aa51bb2fd0ca59f2e3950179bdb3f033de025f7fadc5e3a9d591698ca2bd98eb9b7aff3d0fa17c6ee06a7a6e7a
SSDEEP

3072:Q+TqA1IzklSyITzaPE4IAu1Su+Ah8weD8mRzM1a:DHohzwIAnAh8wvmRog

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2500 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2500 AcroRd32.exe
2500 AcroRd32.exe
2500 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2500	AcroRd32.exe

pid	process
2500	AcroRd32.exe
2500	AcroRd32.exe
2500	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7fab976ec142611835203959c2c890e8a8c58603592d3300820ffc54113f8412.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
198cbbef8d0f4ee997ca843134633bf7

SHA1
41cb3e145c563858dae205010a8b948b6746600f

SHA256
3c8951cadab52c146cce7e3a4d5aa890eeff9273394ef570a65ffd09a39b44f5

SHA512
ad455c70b3f0c587acb6e648c2a57e11e1f061df33abda3da107d6cc21332dc4e39fb84eca31f44f1510e66dfdcc65eb045759a65142485cfe8b3e3255662da1

Download Submit