938e6fc0fd0e807fbc548f44d0b6e18589e99aea39449ae0bc2e6f5406824b59

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 21:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HDFJFDFF89869.pdf
Size

870B
MD5

c8fef6aa70e440b6762dbc78bba8162b
SHA1

1ce3cccb8bd37db5f1a7115381c9e345f86863aa
SHA256

cf2cbbaf628c5fd91424d79f51931c6721e9cf036404c0b8a75b697f1f9cdd64
SHA512

6b7dafeac57c1a0081b29f958c12f97e3a36c78a6ca6ec6a4eca55f884232e3cab93b34cf42a441624411c14a82a95fb38de4a250de357bbd8b406c317ced85b

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2132	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2132	AcroRd32.exe
2132	AcroRd32.exe
2132	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\HDFJFDFF89869.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
be4301cb34c72a943233db6902d16f06

SHA1
17d2efa933b074d7e8a6324e497daa0775d25378

SHA256
e69051506723c78d62392c4079eda8f7947aac6dd478b707d3d72839f7b4af15

SHA512
5761e82ca0e624cdbeec1f8f875e06847ad79dc048b1cbc0b67da94441e5d7102eced122d3ec1005da71f4ceb7d86094b30cf2068486a834fd0b2ecbfb9dcbf5

Download Submit