f8d7222d91a42edc2c08ce97d77ea77690381b507d7c0f08b1d9cbc23a8ec1fc

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02052027_ADD_NAEMA East Meets West Meeting.pdf
Size

164KB
MD5

c12eea8b6c69ded252263411dc006385
SHA1

a1fbf17b54cc1d2a8ebcfba29aeeb6136ab7f2ed
SHA256

a95168cf1613b9d9475d988e3bcb16381064cfe7f0d28b072a046c4bf2d65ea5
SHA512

5234c84c81977caf818db092aac8ba647841734b6aabff0657da090d966bd13dc01c2161881d315b68e5b3be6652d32bffa69f01e86c7f78158d3ec919dfcd7b
SSDEEP

3072:6r0Snruuz6OXEn6fG3gs+lajs0SAtZCIC3bvqXGxZB:Vk64EnAGwdlqSAXCJ3beGZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2384	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2384	AcroRd32.exe
2384	AcroRd32.exe
2384	AcroRd32.exe
2384	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\02052027_ADD_NAEMA East Meets West Meeting.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2e4b0fafb3327f2d87571b514b6ef6be

SHA1
7000685c209bcffcdef6ba0aa6dddde6eea5b4e5

SHA256
2d53238a21c109b0bca60862c168b5335ecbe0789cb039220f07d709b1fc2562

SHA512
d8376a9c4a6d89889121fad6763eaab0958d7c87ffeeb983539fcf023d3b3b4a664b4d9e3f66fc2c48fd55ccdc5fd9d3a3b1a443d889c866b14299513b4306cb

Download Submit