da451c1311fa41acc40d9794174ddbe159b7076f2c628195d16003a96532fb99

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da451c1311fa41acc40d9794174ddbe159b7076f2c628195d16003a96532fb99N.pdf
Size

368KB
MD5

917c2ea5cf7113cbd65f5dfac4c051e0
SHA1

30cc6f85391557ab07241073a46348d6283325e8
SHA256

da451c1311fa41acc40d9794174ddbe159b7076f2c628195d16003a96532fb99
SHA512

07c561a14e7ab7348515f01d0df949fd5c019fdb68b803bd7ebe51b9fc1d250f391b4bbcad4f1b028169ead5eab74293ca5f9f9422e156dd5ef5cf509cc8a141
SSDEEP

6144:DUoxaXlYeMiAiO/cZXrQ9ATsJq4U/WWu1TFwOiysQVpdTA/itim:Qox7eMiTRrnTcUubT3iZYzLf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2056	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\da451c1311fa41acc40d9794174ddbe159b7076f2c628195d16003a96532fb99N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ee66b8e1b37a3a76375dc27d8355d77a

SHA1
33004f169a290d91c1dd32547ede1b981d86972a

SHA256
4d6117f17f322ac4ec330d83449b0386302273e3fd1521407d9c8e5ff003f8d6

SHA512
ab06dcbff10ecfdb7d95e0567399c98eacf7cb7eb9960b83f0fb7557692a569f9b66d52b68e85517b2009703b5082fcb2c3239caf765c8f9c70aad21faf4fd09

Download Submit