b5425ad64313b8112914a9a172245ea6532da65ff113a06cd8922d6352907869

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1-602.pdf
Size

104KB
MD5

17de2ea8d9606247ac3efdaa670e0fac
SHA1

99a798503fa793383a1f599f1b4f4e51023bdd7c
SHA256

6edd4e345d5ab88c188c652f9e60319ae29e1cac8d5888ead1291258a062a5a8
SHA512

bde855bf8c5fd9744eac345ae1aef32ddb6051e6c81c599bdc381315ac651d66b1e644b5e7c9e06a48ab1437d5a35373c9a8bb642111eb8575c2d05236d5a735
SSDEEP

1536:QrM1RzJ4dKTJarM1RzJ4dKVLrM1RzJ4dKqPo4rM1RzJ4dKEhBSrM1RzJ4dKC7X:QASKTwASKVLASKqPo4ASKEhBSASKCL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2880 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2880 AcroRd32.exe
2880 AcroRd32.exe
2880 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2880	AcroRd32.exe

pid	process
2880	AcroRd32.exe
2880	AcroRd32.exe
2880	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1-602.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8e9e11b7036eeb2e88c18e982a44379f

SHA1
6e272e47792d4fb11b5460ab6ccd789ae8a49637

SHA256
db3b855e8b3c75b4d9e1d218425a15cea5ab75d1ea9fb3a6f90a91041a1be6f8

SHA512
11bfaea8274ce0eab7c24054c848ffaec71f461269d3bd408e2319b4e674957cddcb98f425599c918a92dc2a0e4e44f8772d522c3177571f25cfd13363304235

Download Submit