2e96258f3dd21d059f59831295d32d324a849c87bc5a2149a49c97fcf5783558

Analysis

max time kernel
96s
max time network
26s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-01-2025 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-25/unknown-d285c12ef03d01f32a22ac776551028025c0f9a4e51ffb4c379dc3280a6b9a66.pdf
Size

54KB
MD5

dcab7ab13df1b2699165f6b13fac5f50
SHA1

bd65c6b4ce1dc2681b410be9e77075835c47ece3
SHA256

d285c12ef03d01f32a22ac776551028025c0f9a4e51ffb4c379dc3280a6b9a66
SHA512

0dfc5ff6a89dce2a52df427ae9f59b421e49596615403d79acb5de61597d6af1e997f527357ba5f857a38921ef8dc38acf7d8c2a74d8fc58ce0acd9eff8a4f62
SSDEEP

768:NuzdNIggou41dMV+foYlP13HUuK5jmpFVdIuj1lMfYrlI7WQYU214u7NuyVN:0zIW1dMV+foY56pmnVWSqwxiWKC8yH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1680	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1680	AcroRd32.exe
1680	AcroRd32.exe
1680	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2024-12-25\unknown-d285c12ef03d01f32a22ac776551028025c0f9a4e51ffb4c379dc3280a6b9a66.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
37cb4996effb0fa187465940e21c5925

SHA1
1dadc2c09ddaf33778da051286e5ea8f7cd0e63e

SHA256
7444c4d8097cbf5158928c62f137ec0d282083e70c91b83e31aef195bc35751e

SHA512
c6b406364be807cac58903dd73fbfe9e3dcd7171bbe073d7782eaef9becea2ae9281fb6e866e33e2c091efb05fcfef4c360589ce8cd92cbd0a4b3f065c5c8f9f

Download Submit