acb5413e5967ef5d929df20de39ff95b0c7285497aad8f252b134cd361e039a0

Analysis

max time kernel
7s
max time network
4s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
27/01/2025, 15:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BAYS6M36TJD9PAEL23XM.pdf
Size 28KB
Sample250127-sj92datrbz
SHA256 acb5413e5967ef5d929df20de39ff95b0c7285497aad8f252b134cd361e039a0
MD5 263ca4d0fe53494d5be744a3219a2b9b
SHA1 186d102bae1271d3e3da853273ae3b8f1282d2d6
SHA512 0520a27b1b9daf59356315ab23f5df98201971b3f2e439f9174585981481996706189932325f3558535d2dc4de9688e176d85d98709d9e63146185a7569c2793
SSDEEP 768:y2T0zpGvVV4CaoRgekWXkUeyuSoblS4SRl5k4ly:N0gViChgekWXBeygblSDkcy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2220	AcroRd32.exe
2220	AcroRd32.exe
2220	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BAYS6M36TJD9PAEL23XM.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 0b45ed424864f0dc1e3dcf7ed616c9fe221dbc1c6771f532614bf0d3766b1046
MD5 9eb09fd1d2e252afb2808fae94c6973d
SHA1 37c05266f86a57c443fa74598f7aeef9b2b25494
SHA512 de51a314543d55d76ac930b70affb1baf43ac5795d68c2da3ed47fc5d6075081a991d854ba8453f01a682fd5dcb9c86b2cf214e9233448537fa27a4ced8a4222
MD5 SHA1 SHA512

Submit Download