7f95468708c6b2b5e0004e125dc97124cc875d50e771e2b024edd8dc55a90bb4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DAE_633329.pdf
Size

101KB
MD5

e67bc08f303bac0ba69b4b8206bb3c8c
SHA1

ac0b4f688a41e946fc28036581c74bbea5f6f086
SHA256

3c41bfcb0ab91fecbb6f54d21bdaa821a9d9112bcf57fae7735b390f1842da5b
SHA512

1e09f494b931b08e09fee65a5d32c16d7b428e2df059332b83219b8575adbbc252f8a6bfa6929e06b67ad85a22e6958e5d21e4ff46bfd3a3d98d07c33b31cfc3
SSDEEP

3072:z9vILBQRNTLV7NTE5Uo6gt5XqKS0DmtYMDNA9w3JP:z9QOl7y5UoznkqmC45P

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1716	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1716	AcroRd32.exe
1716	AcroRd32.exe
1716	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DAE_633329.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e07b345a4270974b13ef6e88e2e818f4

SHA1
736947ca5511677bfdcba148ae37d9ef8266870d

SHA256
c5b228fe3260d07080034ed833b5f111f3d34fe67d0b336d6275472702c97a62

SHA512
63548aa572cdc081215bfb88fbec0d9cef7796c4ffad5e37c44c6adf779d4b9453891f436f2ea4fea711a29cbaa8da0fa69a88a8597c86cffa6c9d60b837f461

Download Submit