7d33d73375c0b6e3661ae0377aa26648ff1d836602dc8a9c6bbe6e044cffe287

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Carta solicitud acuerdo de pago - ADV-ISES GG.pdf
Size

422KB
MD5

a27bc529500f09c1ecc937d6710dc481
SHA1

8c9cbbe65d9250459cf0bf932d784910ccccd05e
SHA256

941e4cf56c416c3070887b3994a1f30df935956758717a0e240857e34926e707
SHA512

5b7b36d37392289078675df1fb816cdbcb6275052877e40c22cb73f180d9b068d3969693db8d7af76420f01fb0b60040c6505d348fb27ca01d677bbb787d9c76
SSDEEP

12288:oPe6rUsgpEOKUv+UAROg93bP8kV0LGY3Ty+12QNZqtX6Y4h:0eAUHpE2SD93QkV0LGYDy+bNktXm

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2852	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2852	AcroRd32.exe
2852	AcroRd32.exe
2852	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Carta solicitud acuerdo de pago - ADV-ISES GG.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7a7ab38d2de4f9bbe6fe8907e2f9d175

SHA1
68299844ad1e146ebd7e8a03c6aa406bb16146ec

SHA256
c033af67307f49fd2bf1bc93cea227da3760673c39ad02e12b615ffd936ef072

SHA512
0c5df23757a722e5c84457442d97c3a35ad7718aa0c642bb082c3aa30bbc4bef67e1b4a6d10ece79adc13e19ea696f4ac60eaf43ad6188efbc624979b0a4e139

Download Submit