3478b06e4902d0d1027f11c3eedf1dc4c692a9c5fe87e0e7af8bf9d5e80034cf

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CERTIFICADO TITULARIDAD CAIXABANK 9492 AÑO 2024 6.pdf
Size

193KB
MD5

5dd0c72b08b0102e2c898c2627c7bfcc
SHA1

1dbeceefaa10ab9afeef4c484aaa4a06313e512c
SHA256

8913a3450ff19497d2fec8fa8589452a1c2e96a67fa17b2c4e408eca4fcd7ec2
SHA512

a4e02d3f34cf7ef37a3423c6af1e815ba4779073368689aedebabda902a053a4bd10a67dcbd34402d7fd034e2d796f98737e022ca2b6a2cac5ea443fef4c86b6
SSDEEP

3072:2TZLlTXDztlzkQMcY5gpYrPMv7j+Dc96UKFHTJpkzi7jBOVkWXtOylDS+YFkcN:0TzMJgirEv76Dc8UadiCjkVkclW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
840	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
840	AcroRd32.exe
840	AcroRd32.exe
840	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CERTIFICADO TITULARIDAD CAIXABANK 9492 AÑO 2024 6.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
90f8ba8fa0160b9c5398a3b53135e89b

SHA1
cd140c1e597c1e89513d5f8bf02d20bbc53844a2

SHA256
1e752baf60d3829eb8110d2270466cf41ff02ba2cc73454403239abf04e315b2

SHA512
676b0fbc184eeb4ca8a640110a765e170fc83402e9ab0ac1ebe82cdac7dad3d220b3247b4eca2e11ff5456cf3d188ab0b49f7f10a80144c1860c403806a17277

Download Submit