537960c076ed11d2e8e131160dcd0bf6e948fbe7dafdfb43ed2624fe09bdd667

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DAE_39322.pdf
Size

101KB
MD5

f30fd5d8d8b12409c0f1f1690e1f9264
SHA1

0fddb0ffa967952af844678b49c5d2dd826dd3e2
SHA256

5227c7350aa24d64102f3ab553ad194a2ae5dc958521bb22f3c0397bb79f95d4
SHA512

c4e77a3b0c4d63ece5c7f2f30c5326a9f1ed94c1f8871e647352b2532fc3d5103a4105dca23a9d8e0e065916495f6eae339c72dcb16a7104373b1e4867f3da7f
SSDEEP

3072:QvILBQRNTLV7NTE5Uo6gt5XqKS0DmtYMDNA9w3JQ:QQOl7y5UoznkqmC45Q

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2884	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DAE_39322.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
caed52db8177d976573de30541d85184

SHA1
3e6880e6ddaf7601f3ab17181c12e09e112e5b84

SHA256
2d606662648499e2de383d6525d48541cfc293d861c4c434c636fc3c5aae27ed

SHA512
2ddb0d3c50e99a072aba994adb31bc8d231cfafb0d4caf2cf9323d31ce3ccbd3a277c7b78f38b94328773e2b146c61f63096883e6834c0655e2dbe1f53eac2b7

Download Submit