b5425ad64313b8112914a9a172245ea6532da65ff113a06cd8922d6352907869

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1-1202.pdf
Size

104KB
MD5

b07820f3fe464d67b756ad80dd0973fa
SHA1

1bfe265db025eb528b9a709c8f6fc4431161a371
SHA256

cb71a28df4a49a28538e8a4bfa1fe1aa533402c35422114b0686c7b91fbcaab2
SHA512

126b3e484a5bf41c42a4bdbb74a30367d0eec675ae74e8ffac5756e8c6cf85f203bad1a804b54dd05bed7fc80d6fb4ec3ea3d962aa144b3e80e59ee61cb6185d
SSDEEP

1536:QrM1RzJ4dKTVrM1RzJ4dKVCirM1RzJ4dKqzvGrM1RzJ4dKEhBGrM1RzJ4dKCp:QASKTVASKVNASKqz+ASKEhBGASKCp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2092 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2092 AcroRd32.exe
2092 AcroRd32.exe
2092 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2092	AcroRd32.exe

pid	process
2092	AcroRd32.exe
2092	AcroRd32.exe
2092	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1-1202.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
00bef3fe9be8f5bf64a4a55f5a2767f0

SHA1
1a199e1b97b39ecf7eb646d319864d0d40284bdc

SHA256
aee0dc942dd6f5bed1d981016aa233b222b67e3fe02ef144b316cde93f0472ff

SHA512
d4dd22f82bb6155d9f8e398399d32b1789f2a3701a86883c7eb657c21f72afe19d5c3c3e2493db7396a3dbc508716bea0ac7fb2c94d251c18b9b0553ec0a25d8

Download Submit