c66a1f1ae50aca3b1098bf9a921a7ac5e14ef875886444483c5143d0abb45235

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
03-01-2025 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c66a1f1ae50aca3b1098bf9a921a7ac5e14ef875886444483c5143d0abb45235N.pdf
Size

67KB
MD5

5f5be95a00ce1c095dae01a1416e4440
SHA1

37e7e8243f2b464caf4f53ffc61bf6b23e584597
SHA256

c66a1f1ae50aca3b1098bf9a921a7ac5e14ef875886444483c5143d0abb45235
SHA512

8d743362e2855b6312d8ddf94b0c0a2404506301c5f8f63622647d689e64f384028134932f5f2df650d153203700a32b1b8fdecbabd8bc934c6f0f8995dfe258
SSDEEP

1536:b7lNkwddVxzCrzP92wCZ88d8F1jq8ijjK2LFE/3EWYgDkC:bZzddVxzCd2vd2lidM5IC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2880	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2880	AcroRd32.exe
2880	AcroRd32.exe
2880	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c66a1f1ae50aca3b1098bf9a921a7ac5e14ef875886444483c5143d0abb45235N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bd3ac2e7577c0fe843f28061aabf81c2

SHA1
8ccb6b334da41e63d3f76f4ee60c6f82df0f5ecd

SHA256
1a205699416fc2ac65a93933d92caefb3f0a6396e2777ce8c86dd470e1cf33f6

SHA512
f4e6188eb81151016633590250b79dbd3a7fa7427b27baf344387c94874c15cf83ec8fef6f0f9f7467d06fac8f354eadc5118a04fbed67dedd0f1dfb5b5d0eea

Download Submit