4e57cfeec782e7e9dd90163dc3490285d8948e75db9eb95f7208f36897d737fc

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LIBROS/GUÍA PRÁCTICA EN GESTIÓN DE PROYECTOS. Albert Garriga Rodríguez. Publicado por Albert Gar.pdf
Size 880KB
Sample240913-wph2ma1dra
SHA256 cdae6d7100c5d49192b6585af5a04d46a07b2bb45e66187929aab6f5da6d4059
MD5 0c4b5d69f3a37566323938e662929362
SHA1 c77f394a3e062e98a648018b43cbcaadac5689df
SHA512 4783041dbf6413043aba3817b7c4a88d3f2275254837fabcd2cb35397b62315ce7e6351cbb1afd6286b8c23f22bec691acdf15ed40db796382f38d857c372800
SSDEEP 24576:s9sSFX3GQuiMRQzZdUubNFFeTB0d4hZkC7ZZ0gjbXLP+VAYM:sG/QTMRQjUyoTB0ehZkC7ZZ0gjbbP1YM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1952	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1952	AcroRd32.exe
1952	AcroRd32.exe
1952	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\LIBROS\GUÍA PRÁCTICA EN GESTIÓN DE PROYECTOS. Albert Garriga Rodríguez. Publicado por Albert Gar.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 5fdd7999a60d1b3a28f94be07dd173efc5e5bdde6a4b6985f8da824362b5cc27
MD5 a2b2a0adc0ac59eeb51ae684005cc5fe
SHA1 4fbe599e16ed5162fc0cebf3afdd94fd204159ee
SHA512 763717998261082d40732bc3cfd566f05ec8eb91689eb34b792c96c2dab0058d102645b0886b76d0049e311b44036e4b7a898652ea0d7ac6d3288d87473a7a62
MD5 SHA1 SHA512

Submit Download