b5425ad64313b8112914a9a172245ea6532da65ff113a06cd8922d6352907869

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1-105.pdf
Size

103KB
MD5

175f5ba3e8460a763c38714e052211b7
SHA1

d111b374015919d28561a91409dd478f0b5dd97d
SHA256

774cd2e52ec9b56e41f28cd3a2c37f8f92bcf19d765a42d5e1ea135b093a2b09
SHA512

beb08c957fc2bafa06bd2ec76e355fa192ab6c29a621943148b9aa95ad209417fd1507f31f6a5c59d096af90117247c0fa067e5818b42bf3b24b31aeb66b999d
SSDEEP

1536:QrM1RzJ4dKTSY1nGrM1RzJ4dKVLZrrM1RzJ4dKqvrM1RzJ4dKEhB1rM1RzJ4dKCF:QASKTRVGASKVBASKqvASKEhB1ASKCF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2668 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2668 AcroRd32.exe
2668 AcroRd32.exe
2668 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2668	AcroRd32.exe

pid	process
2668	AcroRd32.exe
2668	AcroRd32.exe
2668	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1-105.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
086497a84d9ccfe74c2ee7eb05b46930

SHA1
67a461bb6d89b0c1209453d629510bf4f53560db

SHA256
e215a046d565a247a26bcc4b7a70a080a51acbfd35454e28f7abb97d2795570b

SHA512
d85401ef3631daa29f5a343386ceaf0a57292d4dc322ca764ead120af1bb96d08dd5cf717c55901b284cddca16e688ea32d811ede8fbbba1a7021184d1824ddf

Download Submit