4447c8ea6642b37538822292dc46192a7039dc54ab0d889172ab25dd15353f11

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4447c8ea6642b37538822292dc46192a7039dc54ab0d889172ab25dd15353f11.pdf
Size

2.9MB
MD5

d4f5b98d072f061e4ae41a8fb7c9bf6d
SHA1

4443abaf018dffb34746b649e3b289c97082e778
SHA256

4447c8ea6642b37538822292dc46192a7039dc54ab0d889172ab25dd15353f11
SHA512

05df53c39122be884130d725f1fee26fc54a5ad3c7b33026a93ff298148eb509460cca32776aa4704f8c8e970970e9f633077f2a3ee1c4c6918282c0aa9b91f1
SSDEEP

49152:I66fsKpKV8fJTaNeX+2faOrNETjuEH51dYEX+WYvdfzgb1gdu0fl5X/oMlf:IT8ifJTB+8rN4juEH51dvOWGt5du0fQI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

AcroRd32.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid	Process
2796	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid	Process
2796	AcroRd32.exe
2796	AcroRd32.exe
2796	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4447c8ea6642b37538822292dc46192a7039dc54ab0d889172ab25dd15353f11.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ab897eac7c119266ba104255932a7020

SHA1
ed9a908d5dc31daf8c252be05d17ee1089ca7b05

SHA256
cbb116ed190e51ba1ff6e6884f8feed65ab5acd801a18bbea79801aae4fdae4b

SHA512
f263d9852c0ded498c647fa0e7b14cfbfcdd29af7fa30dcf5276e6208943407ea3915349c13938dff06e70bcf000d4d2179576c39f5a6740d8f86c2b5957ae6a

Download Submit