Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-11-2024 20:31
Behavioral task
behavioral1
Sample
RESD7612172EA_DANIEL REZA SANCHEZ_10.pdf
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
RESD7612172EA_DANIEL REZA SANCHEZ_10.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
RESD7612172EA_DANIEL REZA SANCHEZ_10.xml
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
RESD7612172EA_DANIEL REZA SANCHEZ_10.xml
Resource
win10v2004-20241007-en
General
-
Target
RESD7612172EA_DANIEL REZA SANCHEZ_10.pdf
-
Size
78KB
-
MD5
445a1c25d70c2ca6e5a5547bff3196e9
-
SHA1
42935fcc43ec7b4341f51801a606e2eb5d59f697
-
SHA256
eaa5f0082f66040aa6b35c82f83e86cb89442f717d5d594b4ff8d9367a5cffc3
-
SHA512
a193815faec2390d5a9b34f6982e501723a76d9bb923726614c75d01d495d752a16018bcd997e9ea487d5b27ccfef6824f2d8ce196800eaabe3d110af5fb2698
-
SSDEEP
1536:XkGGZ1gVo865R6vH7RF5dENLByOJwQCNpR0BavyhR1m7yCwNkbLKn5tQ5NqJ:9guVb65AvH7RsFylQcwa6hR1m7yNNKLc
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1924 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1924 AcroRd32.exe 1924 AcroRd32.exe 1924 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RESD7612172EA_DANIEL REZA SANCHEZ_10.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD502805b2c75bff1e00289c949bc6721b1
SHA1f29362efb73d92016522f175d1d77d3655c58f38
SHA256e7d62c109733fc1045049aca81866829d6c736fcf42402c01fc9ed3ca8578012
SHA5121faf3a5385a9ceb89cd4d28fba3bbe881c501a695c3d13380a91b837c84c826b8d2ed0324d59646c6bf507d5589dc30c794be344ec9894e6c53aa157ffeed764