ccdb44f50078e9da344c0ae2bfebc7f946e72bdd78622934da9d6505f9f6ccf6

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DAE_74537.pdf
Size

101KB
MD5

b63629fdaa21699ec7a672892ad79e80
SHA1

9d409ae6aba73a0ec975b2314d4b288a6c252f40
SHA256

dafe689e6b2b6bafbcda32adf3c54bf56e1579d719cbb834f15c1960848a5283
SHA512

6570fb3e54af38b838456bc7f03d069c6cb7e17ae558c7b585f6e268f7b8ba846ffaaad389850106be00a861a2c9af4d3b6159caabe8a96d0d632c0531ae9958
SSDEEP

3072:rvILBQRNTLV7NTE5Uo6gt5XqKS0DmtYMDNA9w3Ju:rQOl7y5UoznkqmC45u

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2176	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2176	AcroRd32.exe
2176	AcroRd32.exe
2176	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DAE_74537.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
41514161096433da343ae57cfa9ac3dd

SHA1
cb74d8e70fd83dda19965680f88f67face238f41

SHA256
cfb2d9dfbf716413ee517986ef37b3988d74232df6f8f671cc45dc31bcaff1e3

SHA512
83b5125654238c3776133c2b1448af5067a42b5d60d2ed2d9b1e77fd3ab9563159beee52cbaf5c0c93b51e84cdcbd0386543dd76ebba45b5dcf33940fefe3f62

Download Submit