b47d99249517d5fee9596fbca37710e5d368f5e294b15f08b20f9af39663edc3

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/03/2025, 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

797140e2126886c3c9a435c08533762a5ee71dde1649163463465326a0d3e040.pdf
Size

500KB
MD5

3bb293201f478ce723c1aed30f2fdd5f
SHA1

7914c6c8fb63f8c979f6851af8d5ca56f2568314
SHA256

797140e2126886c3c9a435c08533762a5ee71dde1649163463465326a0d3e040
SHA512

0eb6a80178f4341d9f0d23dad2039be5cf8b5f907746672a661ba8843347ef6f66b3618e76999ff1a1875dbec10501e77a2b5020a3040bdfab6be5fda95b45b8
SSDEEP

6144:ZDar1lQrNdE3r1trDLB/30HEasYGN18pIdVWoz8tEv0Zd9GTAH:ZAMrQX3qEasYGJlQtJ1X

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2920	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2920	AcroRd32.exe
2920	AcroRd32.exe
2920	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\797140e2126886c3c9a435c08533762a5ee71dde1649163463465326a0d3e040.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1744c18db8572b7f882b7ea839680d37

SHA1
ac73fe9a2e18a7ea747f59688fbad7a7dc4c656c

SHA256
7f429c52ca8176306b5ab98ec0ee42505a8da7f3b37b95bbcfaefe1f1c7fc0e2

SHA512
38627ed517554fc7f06d233d0de1951d2f2e34681747d9ca0ed43c0d76812b698db9819da62f24d291bae18d4a5b5d71d681fff2361930032066af68d94ccac6

Download Submit