24b4ab604c01ad537704980ce0e2dc8f97ef4f59e0453918eed6de272dc93ee0

Resubmissions

19/11/2024, 16:46

241119-vabhkaygrk 6

19/11/2024, 16:43

241119-t8gxkatjhj 6

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Carta solicitud acuerdo de pago - ISES.pdf
Size

432KB
MD5

82409d40a7f55d632c56420b6237dafe
SHA1

209a58e044a3aaf9c9660e979f5a54b0995ff2c2
SHA256

824cb15c99b803bde8e16f411a3e03efb80e27d03dfeb000184f745ad4166504
SHA512

f28c9f53f6f3bd3e78e0803c6a5902a6e294872dacdaee64ec918030175a5ac5bc0a4369b4d4a8b74638d35f336b46b8ae4ee422b4a7e5b1bda65ffaa3d3bb3f
SSDEEP

12288:k0mOA9nr+Uv+UAROk8mrCFobP8kS0LGqmwziJum+12QNZqtX6Y4z:k0mOA9rHSt8mG+QkS0LGqJm+bNktXA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2816	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2816	AcroRd32.exe
2816	AcroRd32.exe
2816	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Carta solicitud acuerdo de pago - ISES.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8ed4a3772ddf7f8cb30399585a72339a

SHA1
421924652d27b80116e8aad965d5e1e8750a9ef8

SHA256
a46491e19f1edcd80c053e2c2968e70c30aba0274db3cfdc49d13a33db1f7c9d

SHA512
b249ca1de17d87375845d388958ffac7b404e5afa4ff0a6e842f8d36363f482434af9c40ee7bd4e9d63ed0d6c75e5c224fce4c901ffb6bb0ff94cca17a807e39

Download Submit