4e57cfeec782e7e9dd90163dc3490285d8948e75db9eb95f7208f36897d737fc

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LIBROS/Sistemas de Informacion Gerencial-LAUDON.pdf
Size

24.5MB
MD5

64b8bb36f978b784975de0399870cd70
SHA1

3e119a44784847223a27d893b240eee797e0f777
SHA256

96ae4c992d0bc82f86f96b036ad164e0505c276a4c37d9ad1a10c661c1b5e84c
SHA512

81ba610abf1f2a5246d7ad46c28ed8f86726b23fa6a33ff10d67e24d9693061de9c30a7ab3320857bc7fc5e77a42bb30a843ae1303f307a4b93864b734eb2d29
SSDEEP

393216:yY7uZAimQELP4PIj81T4FHDmuZY1s6PZeAtzx12Gam1ToTj+dQGPccwZH:rnq+81T4tdZUZe+zxBaGTBdBPcvH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2024	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2024	AcroRd32.exe
2024	AcroRd32.exe
2024	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\LIBROS\Sistemas de Informacion Gerencial-LAUDON.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a87b52676348ce2b818e987e0a80981d

SHA1
584a48b93288e26acc652ba2af4a7a429efd869e

SHA256
19f2531bc7a8c3309c7220625002a991189205439b8861305cb81558b2d2edda

SHA512
bd55edaade5ecbdd73070089b7a22c12ec6ad20d4d1709ead474c265e830d2daedcd539c450f87c980d0f576c336797a6ede2fe4cbcfa975fb2d938697761755

Download Submit