d762e1bf1609633685afbf4b28fc487714dfd716c5a4a45a4aeedd4f3a822bfd

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$R9U0JA2.pdf
Size

42.7MB
MD5

afbee415596a2c36a4730820f46b7164
SHA1

af3f957518fc4e7288ca0a68f1c4b0bab7a1dfa6
SHA256

e9f0702bc050af0ccdeff438172ff4f67c69bfa6489881799413eb11f77e8605
SHA512

c4ec0ebe117782ee8043fa1c0fac39bf993780c00d0d1eb20c924638cecdeec2f7749f428810b2ec3e570764fc8f823b1bd753937c4828526a7dc9d7e992e123
SSDEEP

786432:q/wx4L50dLth9IUcEtYDL/eJEGgD2p6S5oga6TW731rcVboLLw68d+Z:qYa0UUcESDLWeGgDY6WoZ73dqb4w68do

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1792	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1792	AcroRd32.exe
1792	AcroRd32.exe
1792	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$R9U0JA2.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1cbde1acd7bf267a1e96f1a6f7a8c494

SHA1
53b2856942ad69e10f5dc7f4e9d6cf467ddc1c66

SHA256
de94b28729dff12dbce6ce6ce8c09c7b15bb7773a1d3428a89c6a16d85a9bbd8

SHA512
dad0f9f190b704a8801f0d5f68f82309ac952fecedbe96d64f64bbda10e3924ef9b006de6b398f361b37235ed561b85dd845dc87db70601e49410888c00bdca4

Download Submit