4e57cfeec782e7e9dd90163dc3490285d8948e75db9eb95f7208f36897d737fc

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LIBROS/SOUSA Y EFFY Administración de los sistemas de información 7ED.Me.pdf
Size

12.1MB
MD5

2a5fdaa9ec572a8c34f8920da4d0091e
SHA1

a1c596d67c40692c62153568423313d6f1eea939
SHA256

9e3a0b26fc74a9c5d64c19c02a5f9f46b1fd2f333d9100cc561076d716a54977
SHA512

a394a62da31a50d2699c166425d3fb47a218aedc2c4f3c39ae7913d711be4b0d6e923de061d0c53dbae819be6a1dff4f3ab4aeccf3a2d023fbb341f23198e0ec
SSDEEP

196608:ah3QBy9OeiI3zRyCF3hMP/+jSdHXs4es0caHBGMeFyvkLl:+ABOaINfVs+jS8gahGM+hLl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2416	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2416	AcroRd32.exe
2416	AcroRd32.exe
2416	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\LIBROS\SOUSA Y EFFY Administración de los sistemas de información 7ED.Me.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3162051af74867ec85154eb1b12b1e82

SHA1
6878c26ac21f2c6f08a3bee6771649ea0429ab03

SHA256
ec66eda18e2933be39c1207e18552947f43ab362c48734997876d9d8964295f8

SHA512
f34f0c9bec40df4b63766f60408080d6444687def8deb66ed18c7ef003c34e502a72b4f85e9af0a834a7d36ab82ee3244b6eff945ee22d839987d5812b2f76ab

Download Submit