b97b920a8e70f3008bcf88ca81fca946eb1efe0d4d1c252d559c0dc2d65f8c28

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 18:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fv08002469850002400026260.pdf
Size

95KB
MD5

62071fcad8d8a98b0b90add77479c706
SHA1

dd2878489de46df7c8b65dcfc4b9afd3ab7e9ae5
SHA256

b97b920a8e70f3008bcf88ca81fca946eb1efe0d4d1c252d559c0dc2d65f8c28
SHA512

28be53ead01c7d212b618395beb619f715a445dee00ffe8c64cfa2a23eda01704fdc0429551edca2ce41181b7a44b6f6fd67c75f51c9d28bf9b1106d864fc779
SSDEEP

1536:jaxcmozabA0MIfuhM2W78idbUo/l4HvXMeIZvv/cfqn2yL1q8D:A4cX2m2W78Nf8FHcfo4S

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2780 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2780 AcroRd32.exe
2780 AcroRd32.exe
2780 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2780	AcroRd32.exe

pid	process
2780	AcroRd32.exe
2780	AcroRd32.exe
2780	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fv08002469850002400026260.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
faa09eb82960fb356829d491d8a3214f

SHA1
fd7c0e977325e1d7204878db0c55f2a879206aa0

SHA256
0e9af93ec599e8e1a4e34b6c911bdaec9c14ca2a65aa3e743575573edb356bea

SHA512
1e13914668337e4f9ac2f720bd1b012b18e1911d0e52eb4b98cbd3ee0fad2fe950ff11eea4f50b45b908e0bc13ec854064f7ebaab6ac9484a3fe280e3cbf3c2d

Download Submit