b5425ad64313b8112914a9a172245ea6532da65ff113a06cd8922d6352907869

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1-102.pdf
Size

104KB
MD5

239ca686546dd7a2ce0a66ad25b937e3
SHA1

e8df78ae00dbff0ec81fc15c6cff84e6618b06fc
SHA256

de3ae5b78ff1b4a563ea3c458e4b9dd0336ab2fe18fc8882c7487dc44dc71407
SHA512

545c1ad9d12be3245dc09b788ecdddf4089bd7a0ab233ea760f6fbe049a3587bdfbdad3f378c4c49d3652cd9d1f67dca2e9b9fa407bc816738c49acc5980de44
SSDEEP

1536:QrM1RzJ4dKTYeErM1RzJ4dKV+rM1RzJ4dKq65rM1RzJ4dKEhB/rM1RzJ4dKCe:QASKT2ASKV+ASKq65ASKEhB/ASKCe

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2704 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2704 AcroRd32.exe
2704 AcroRd32.exe
2704 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2704	AcroRd32.exe

pid	process
2704	AcroRd32.exe
2704	AcroRd32.exe
2704	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1-102.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
50a7832c240070d5d8e0906e2e8a6b31

SHA1
d22e739d6b6dad267f67b6044332e964c247cb50

SHA256
33372456d59763cae9bfbb336f5334d60ce77e09d9b42e99c790c12a4c1c3452

SHA512
383d2d3e31ab6641479b7514753572d90603178e503aca64d2a45eb1a9cf46f9b9f8809e5f969948425148410a77ff1603a0d677bffbcb7f6dcd8235af08ca4c

Download Submit