b5425ad64313b8112914a9a172245ea6532da65ff113a06cd8922d6352907869

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1-201.pdf
Size

104KB
MD5

48e82e742faa362d04362dd2e422e111
SHA1

20e7ab9b5f220b14880a6b1be3b84105652d7da2
SHA256

b9f23bb09535da8007c98b46b6ec47af72641abb25cb07c5fdb1d6629a53741c
SHA512

57aca3f7c7fee5eb2cc323d9cfc84edc8a575c3ecd375c2748f57e40332bc2ddadb97f1b0a1b1bc95d9f5f7ba0279db812509780a4c515c96e7514f140946922
SSDEEP

1536:QrM1RzJ4dKTdH7jrM1RzJ4dKVFRTSrM1RzJ4dKqgrM1RzJ4dKEhBT5rM1RzJ4dKz:QASKT5ASKVFYASKqgASKEhB9ASKCm

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2252 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2252 AcroRd32.exe
2252 AcroRd32.exe
2252 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2252	AcroRd32.exe

pid	process
2252	AcroRd32.exe
2252	AcroRd32.exe
2252	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1-201.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
32cc10a53349625f7d0023a72c1c2972

SHA1
8e15be29d5eafa2a79cebbb30604c8ee794045a4

SHA256
a475009bd983532757190e1f6e0c63b2ed5edd759b9e78547a8e260bcbb502a6

SHA512
52aee44959e736a49d4746d23e4e3e784288241fe5b7adbe29ef51675358631ff8c6bec01aa0835419e3471785806e0a7caf47a743f9321775e63d6887a1d139

Download Submit