04e53ff5b51eff665b05f961de1fcb3baf04f15f3532aeb2dc694bed66e22bc1

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04e53ff5b51eff665b05f961de1fcb3baf04f15f3532aeb2dc694bed66e22bc1N.pdf
Size

315KB
MD5

d2a7b2890884403464352b9d0938ba90
SHA1

fc238be22a52a98a29900c420530c2545a5d1ca9
SHA256

04e53ff5b51eff665b05f961de1fcb3baf04f15f3532aeb2dc694bed66e22bc1
SHA512

cd403560d912f559352095b1ada52bcdd2f00a695f4ac3bca86887b95b0f14d6df015c3c5f6402d5c3a7efa1376f43041d5e17cfc0d40bbef1b798ad342cee13
SSDEEP

6144:qMVWAyJRJI5iz/lJOMeZ0sYoeKxcSZpufxicwsWA/FdL4E:qMqRJCgo6syKxdjufooR4E

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2504	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2504	AcroRd32.exe
2504	AcroRd32.exe
2504	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\04e53ff5b51eff665b05f961de1fcb3baf04f15f3532aeb2dc694bed66e22bc1N.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6090005e524a5f06ca68e9f92d3ae368

SHA1
94e484ebb634c634e56c1667a3e9ef6244f3c2d0

SHA256
b0fd113c08e3ef4fbdc90d9556231290306a51203a716a514d1601cd20c8c02c

SHA512
a45d37c275abeaa357eae589f662775ce49b87687d465407b90c9e08de0875e2867d1cf862b1c6f9ab38177cbfa0af65851e9f5b5a0b79f3c438c408a38678bf

Download Submit