2e96258f3dd21d059f59831295d32d324a849c87bc5a2149a49c97fcf5783558

Analysis

max time kernel
95s
max time network
26s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-01-2025 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-25/unknown-d1ec2ec2825c2de7f5a5cfc4ebc53592c6db75e26b219034b7c22e97f097e555.pdf
Size

19KB
MD5

469300734563789567bfd4441caf8c40
SHA1

4d8c373468411c819405a62cba0b210199c0b947
SHA256

d1ec2ec2825c2de7f5a5cfc4ebc53592c6db75e26b219034b7c22e97f097e555
SHA512

4d85481d1a9c156085eb11392345b7c856dc0bf717a2700cf0e29e577651f3728eaa39f50800d2a8e73745eda0332256b5dcc396e2a42e2cef17810a64bb0cad
SSDEEP

384:qPvquYE0TcRs4gFUUUUUUUUUUk+If1BBNfPg4S3MxzIDTx:q6uTNgLGVlgU8Z

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3064	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3064	AcroRd32.exe
3064	AcroRd32.exe
3064	AcroRd32.exe
3064	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2024-12-25\unknown-d1ec2ec2825c2de7f5a5cfc4ebc53592c6db75e26b219034b7c22e97f097e555.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c77c9d60698cdd1e071048df67c08741

SHA1
ce99bf60f5c9c9ce703b8df5e303943ef006a14a

SHA256
015f272b69bcbb13ffb2e5aaaf431d9df9b02c6d27b570419aee38f9c78836a8

SHA512
b8f834b3ded0b7822f34c8c8b89467402a0f2c20911c5d4be7ab4c1556f8eb5a8a054a6a3abf8248c8ecbaed2f5ed7903d26489292eb24faa852178e9470e372

Download Submit