485939cbff47d7081e327309295f67ccb9be619ae72d8334c13157b9ccdf7a00

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
27/03/2025, 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

assetinsure.com-986477004.pdf
Size

20KB
MD5

a2bb69f407e7339d1b7e4d73e90995c2
SHA1

328a6d2e7b271d7bf2c0a103ecc301464434b3a8
SHA256

b3fcf79162a2411e6c5837a45fbbc0eb0e05f7c78bf5aaeec9433c44f2986818
SHA512

9e08c40ea365ab336fcf86bf008055218a9cd1188526cf81aa6a961dfe3f9b4ecbfc5edaa989586a09cf9c0f578094e95e91c42e92def7ebd4b9da065a582701
SSDEEP

384:ayWN+1D/SU4hTmr9dOSEnNXCUSLMJrTEb9CECUSr1fhT0j2e75fBNOlnQsCUSy:ayW0AU7r9dVYXggrmW1Ji2k5fBNOln5T

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1628	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1628	AcroRd32.exe
1628	AcroRd32.exe
1628	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\assetinsure.com-986477004.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bd77633008c2ec814a472681b80efa91

SHA1
a8dffb601c5d92666d317dbd4306b374dc5dba75

SHA256
ae2d33553be92dd5725083a836092fc6b105ad18e7dcdedc430bade9fa286fd5

SHA512
148d5e2522897121fa6a985bff40cea0b563b4430c44584ef84d4b2c2ef319d33ae87d549a31fc050b529a9c732ad9bc775356cdbbcfb725c11dfac998a6e602

Download Submit