06499bbe658d9fa292c9e3772b047182792566ff37082f8bc3b66e7b827cb1f8

Analysis

max time kernel
74s
max time network
18s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cv LARAISSE Hiba (1).pdf
Size

686KB
MD5

73e7f7afc2f622d0e88764fe9116cc24
SHA1

920294f6ffa9eb6d56b3ee59d041b8d08ca40849
SHA256

06499bbe658d9fa292c9e3772b047182792566ff37082f8bc3b66e7b827cb1f8
SHA512

f16cd7ae7b077f0d8f00f100f15f4d229e6cf493b7990f10b348814548315db0cd9e5ac39e65547bb851f4a0baa4e3347cba4c799748619a9d6ac706b52731f4
SSDEEP

12288:KVhnq/Mc+RcOKSnxOYErz45VVLL1c+zjW4Z19EXqfHzLSYu:s3fRcPSnoarLL1Dzj9Z19kAX0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1704	AcroRd32.exe
1704	AcroRd32.exe
1704	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Cv LARAISSE Hiba (1).pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
234882c08d4298ae0b9bafc4b5aa86d0

SHA1
816d0843dab3cb3cd79dbccb3e9281e566b87501

SHA256
80ff0e8f711c2d9819c6fb69328bb0ea3874ee0c720c72d61285905d91d4d8d4

SHA512
230573be56894f1f02df339d5eac900348eb0d249c99fbfadeff89f622a4529a153db1ca8bb91f7e19a8da4ff2c06622b993f7f359ac8bfa481cab6d8cab1563

Download Submit