bc27b3afc72c925df021166fccc262ccf75e2be6f8b04c6772ed36ee8d5a1de0

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
07/02/2025, 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54678013c8741db3340960e54ba93001c27619ead5cf5cc2eafd4c0fcf797ae6.pdf
Size

161KB
MD5

e75185a22cdf243af1a5f41fd53d9a0d
SHA1

b800205252362b86b10a8e8f56e21143cadab40f
SHA256

54678013c8741db3340960e54ba93001c27619ead5cf5cc2eafd4c0fcf797ae6
SHA512

2d24005c1cb99dcda4ee42e6dee07e312f54359a33a73f64d11321d9fb7a661ebfc722dc12745d0bc30ca4577642bf676fc7748923f24a74eaee6283097cc2f8
SSDEEP

3072:Gnbp8yo1TxQ09Qq0AlutdCZpE0pxfyBPY02AGWeAR:+gxQoSdCZpEafqQ09GWeAR

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1976	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1976	AcroRd32.exe
1976	AcroRd32.exe
1976	AcroRd32.exe
1976	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\54678013c8741db3340960e54ba93001c27619ead5cf5cc2eafd4c0fcf797ae6.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fa6fdc814b3a5658ba56a61532cb2f87

SHA1
25886bcf1de2b007625af08dfc0c158cafdca158

SHA256
0bbac22c9af5221f89efc5d23f7367aa8c0c9f6b08af0c9f2fa13be05687e196

SHA512
24e2f7291d56931a6832894bf493b53ae63729c9a32ab6843434d5eafa5b50cc74a034488b37b471e79087fdbc2b017c5e7bd17f5769e1aeda1b5d6230dfc7da

Download Submit