7e7263b7b42454388d2c7fe248ee2f214182d600ceac8314f640b97b9558340a

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NC-CFPL 4712 MERCADERIA FUNZA.pdf
Size

106KB
MD5

8951da95466a06f86b3562cf13a93f3c
SHA1

456510ae53d2b9ca5357792af1c0d2c70efe191e
SHA256

4328ecb1324084240c01d2de4d03af4c518a8d16f847de2b545713c72c0749a3
SHA512

317fd8b565a20e75a0bef511bdbc6535e57449c0e97fb602348b424d37fbba42de8679e9a1e69123eeb753d2d13070f19d2deab9dc527f256c34811f35ead288
SSDEEP

1536:U7ZyMh1vlxT3hpl2hbWbv1TBLK06fxZRhc/t1Txuy6Scxj1osEUNavspcK9KLxjZ:5M7Nxbhp4pWbvHEPc/34HypUBcKoLxd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1372	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1372	AcroRd32.exe
1372	AcroRd32.exe
1372	AcroRd32.exe
1372	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NC-CFPL 4712 MERCADERIA FUNZA.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f621ab6cbfd26ac49534f68fab0ed2fd

SHA1
c7cda3dfc36af327db997ff72ac4ac045a00eff5

SHA256
ba6c41382a90c3274a6e35bef06137b628dbd48796a9decc0a8ce789938abff3

SHA512
e3fe14112672696c4373db90b254016cd140be68657cb5a2463c444660f3440dfa277020315f34ad1f84a588a80035c4b747d961d2d20a3a87477373f2de21b1

Download Submit