0173dbe5dc49d7667d3879bc6a23e2e8863d49873cc8f6fc1e4a0f6f5bed7391

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DAE_817587.pdf
Size

101KB
MD5

2afba233a43c9b1868ec58f0b132fa20
SHA1

0dc249123ae2593da3d036970261888a4b8b42e6
SHA256

3e0381f386570eb459737cc07b8b9cc2d4390102c511fb6550adec6aa44669ed
SHA512

254d4f79c2da9260d2f8c4264a80aeaaa6bb7966b6fbaaa6c22073f1cee599e4ff46185eb18347e9d8f24525fcf1f5adcfcc19508b7cd035e6dc5b8b446c9e4f
SSDEEP

3072:SvILBQRNTLV7NTE5Uo6gt5XqKS0DmtYMDNA9w3Jg:SQOl7y5UoznkqmC45g

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2852	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2852	AcroRd32.exe
2852	AcroRd32.exe
2852	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DAE_817587.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e350ce89b388809b1107a90a0fc8e160

SHA1
45aaf0fe750c2f48a2777a7edae8196facfa223d

SHA256
fe50ab2d44a4b9e5c98380c6c8104e5d5a93a86869d38e4dc8e62e415ffffc41

SHA512
f1194504c13db0d8c97a6e5aca41f9e9def2c60a32a4e69bed8a61f4d0234335de2d08b86c2ee339f655e4310f358e33e7f05935016f997c24d9d4be9116a631

Download Submit