eefbc34642f0bb25da3b12284950391214672f98b1f6079a60b788a4dab9fa49

Analysis

max time kernel
96s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eefbc34642f0bb25da3b12284950391214672f98b1f6079a60b788a4dab9fa49N.pdf
Size

27KB
MD5

143ac251893d98123a1bb5208d9941c0
SHA1

a98b3bf1556974ea8ea568111c05584f1845dc12
SHA256

eefbc34642f0bb25da3b12284950391214672f98b1f6079a60b788a4dab9fa49
SHA512

b839c0186a9365f9e83a23df7abe6a43658dc820d422213d04bbff1bdfcb4bf21f33d90fbb0047124083161f02d7a83600c6644a987cb6a896ccc340f0acc53f
SSDEEP

768:JdJzEMSMay1R3EmunxJKlO9Zwk7Cx66uTNgOC1YHchTDp8:s9Zwk7Cx6rxCccBDp8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2044	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2044	AcroRd32.exe
2044	AcroRd32.exe
2044	AcroRd32.exe
2044	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eefbc34642f0bb25da3b12284950391214672f98b1f6079a60b788a4dab9fa49N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cf870ba7f5618d91b9708ef8afad02c4

SHA1
9b0f1bdc4332a2f71a2be2ab4c591440324df63b

SHA256
8ea35a518bd626a6cb3db3e91ae6e4972c568d8ecff481137278a57cdd71555b

SHA512
ff22a9a2038d1e14b3b9e98f41e943c1983a228af46c954b470e2ded25e97967a5a5e94af27b25669984d04a13ca828c9b102e758df22e5b643124edaa4b1200

Download Submit