4e57cfeec782e7e9dd90163dc3490285d8948e75db9eb95f7208f36897d737fc

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LIBROS/LIBRO Analisis y Diseno de Sistemas Kendall y Kendall 2011.pdf
Size 9.4MB
Sample240913-wph2ma1dra
SHA256 34895879906353bbc47360547027813294e2d6c8f8edd18f30f0f7c178e56476
MD5 8b9c7a0c0f1cb483f60ca2885b5f1dab
SHA1 737efe985aea26717b8d22e78f0ceb6b870905ab
SHA512 75671b32947b3051a120d6a6a24acb0c6b2c66767d73b7b0bda85e8d1139b6d1cf35fb27916315538fc91c62b2d111d7a2b0959333c5884e11186c1a1dfd22d4
SSDEEP 196608:f+DlhhhhhhhhhhhhhhhhhhhhhW13D7GXQOWFMIjMMr00in7FNlB3A/Yy:f+D+13D7GXdWiIgMrS7F/B3A/3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3036	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3036	AcroRd32.exe
3036	AcroRd32.exe
3036	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\LIBROS\LIBRO Analisis y Diseno de Sistemas Kendall y Kendall 2011.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 09170faf68364fd49ffa4cf321ce25fc5633d7c3c613ca6743fb39b8d4818c0d
MD5 059922c4fd5f4ebc37ded0ba3bec1290
SHA1 2f2db780a5da82a1d948d4d9b3905ca75b782de1
SHA512 fe4d670cb227e44bcf6f8fdcc4f84e856060379f9f92725b8c78665b29fcb9babaa3fa94d2816f04e0687146bdde579017a03afa92311d3fe9f7c3e154727dd5
MD5 SHA1 SHA512

Submit Download