2a422b69e3dd9dbaaf783a9e9efebd4ee416e7a6fa86d58eafc6da27f06aad24

Resubmissions

23/08/2024, 17:42

240823-v91xhazelm 5

23/08/2024, 17:33

240823-v4v43azdlq 5

23/08/2024, 17:08

240823-vntw3axbjb 5

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Cert_'agosto fahir nuevo.pdf
Size

131KB
MD5

470de24a7e502c3886c1d7aeeef70da9
SHA1

45bc5f927e0a45f645564f16449a1f2905098ae9
SHA256

61d41027219fec10cdb15a4d1fc83a8517845a4b15c301a90b8eb09c296012db
SHA512

29110ab15d5828300f9b9c3c817e73f3888397edb83224243af6734b003e31d127f2a9cc4dbad71bc48a59884b802be8669fc4d8c376edc690e763ff9edf2231
SSDEEP

3072:llkKSnNzifG5iWih64YUE2PDRUUrMUYy7l6x+tRA:NSNzQhsUE2baFUz7lEqA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2192	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2192	AcroRd32.exe
2192	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Cert_'agosto fahir nuevo.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
20a4002e0b0907f4e3428250bd6a55b7

SHA1
5e9095a8b5c839b680922c29a8bdf344a7a56cd1

SHA256
a420276a2f776174f32098f756ada5f6ffa3763585e88dc04442a167c9019d4d

SHA512
490f4951bf0eff556047f52f175f881b7000a064261ba0edbc1796ac691f1016a82be319371a8611c84be6c57e355127fd860b878c91eb1bc398e91a881e4172

Download Submit
memory/2192-0-0x0000000000DD0000-0x0000000000E46000-memory.dmp

Filesize
472KB

Download