24b4ab604c01ad537704980ce0e2dc8f97ef4f59e0453918eed6de272dc93ee0

Resubmissions

19/11/2024, 16:46

241119-vabhkaygrk 6

19/11/2024, 16:43

241119-t8gxkatjhj 6

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 16:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Carta solicitud acuerdo de pago - ISES.pdf
Size

432KB
MD5

82409d40a7f55d632c56420b6237dafe
SHA1

209a58e044a3aaf9c9660e979f5a54b0995ff2c2
SHA256

824cb15c99b803bde8e16f411a3e03efb80e27d03dfeb000184f745ad4166504
SHA512

f28c9f53f6f3bd3e78e0803c6a5902a6e294872dacdaee64ec918030175a5ac5bc0a4369b4d4a8b74638d35f336b46b8ae4ee422b4a7e5b1bda65ffaa3d3bb3f
SSDEEP

12288:k0mOA9nr+Uv+UAROk8mrCFobP8kS0LGqmwziJum+12QNZqtX6Y4z:k0mOA9rHSt8mG+QkS0LGqJm+bNktXA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1948	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1948	AcroRd32.exe
1948	AcroRd32.exe
1948	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Carta solicitud acuerdo de pago - ISES.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ca6ba759e351491a843f325b7257a27a

SHA1
c0d3fb423cfd0cb4421407d1940ceeb9872eb00f

SHA256
4fc1aa326f7030c69bad31780eeea1d23784ca8fb71b6f0a12bfffccded2e076

SHA512
6689d83138abd144f16c0de7e1a36c18482ceb4f4761e863dc171e8ccd5d73783c6ec1c8b6117d66315562a9a238b84b5a0c5218dd2e6c1c9a8dcd15b70337fa

Download Submit