b5425ad64313b8112914a9a172245ea6532da65ff113a06cd8922d6352907869

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1-1008.pdf
Size

104KB
MD5

76fddd426420ef27a3cc23ada23320bf
SHA1

7c825eed76f4a6a1f4d6f525db70f8f136b933c7
SHA256

8d74d8eabe5a538556be3697a2ffbd680fcd8c0acc77d1b3c849cfdb2480591e
SHA512

9537c80ecdd7746b9d3e756c9cd9af03cee80b05005ba6a0786cb55bc462136de5dfc1b25ee171efaee04b44a383ac7cd99123f6fc2b68f257b8bdea1355dc50
SSDEEP

1536:QrM1RzJ4dKT7rrM1RzJ4dKVnrM1RzJ4dKqMrM1RzJ4dKEhBLrM1RzJ4dKCu:QASKTnASKVnASKqMASKEhBLASKCu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2524 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2524 AcroRd32.exe
2524 AcroRd32.exe
2524 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2524	AcroRd32.exe

pid	process
2524	AcroRd32.exe
2524	AcroRd32.exe
2524	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1-1008.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fd9b0cb89e9cf91e5991358fcc028b39

SHA1
c13e49cd80b65b778ad74ba111130bcf9768e50f

SHA256
4b7dc56b6c17d17103a17040c352531d37637ab8d338de4f6ceec8af4a72fc5a

SHA512
f2c9153c47efa116d4e8ae39e798f4d0f19e1cedf5d022329d7653c3a178f30b357df31545cb2548598286d2bd94f0a58c7d35baf41b5010c14ce60e7765eab6

Download Submit