ca8e1dd2e6d9ea0ebec75f714d60d6246e04ee0fd97d6a077c0b96603990b73e

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10. ACREDITACION DECIMO CRITERIO.pdf
Size

71KB
MD5

09459265b7cfd1d73253118736685de6
SHA1

c2de79daab4a27bd77933c2840eadebc141cf3ca
SHA256

414a1ca119bb1da955cc1bf9c73359b7b779148fb15253a2b1086feefaa4e52c
SHA512

7e1a9cf2bdf9b33452420df55c1d4b519337c612c7e3fc5f3cde0c46abfc7ba3e9c2ca14faee3dcd0ded1cd9f50e52d13aff6a27acf74fcebbe2d71551be1a50
SSDEEP

1536:GoIO33+ZRyijAipCtBls6CWYX3ASlM5yfyiMSxcpYrHn1ALog9ti6h:PtHeRyWAipCtTsNBAB46i96pYrH1MogN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1748 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

1748 AcroRd32.exe
1748 AcroRd32.exe
1748 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
1748	AcroRd32.exe

pid	process
1748	AcroRd32.exe
1748	AcroRd32.exe
1748	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\10. ACREDITACION DECIMO CRITERIO.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3274072accb610f21cbc7da787cf31f5

SHA1
9c1ce1f2d1b2927194257aa1b3410937bd2b1e15

SHA256
5578a4cde472fb2d49ba6e7ff44fdcef6dd8786767594960fdab2660e31ef553

SHA512
46cf7f58d663222f385c61edf447ed59fdc89c04590d1133da6f157194904c5c5f1c72b4b9e4386f783d0edcaa320398e51f5b609db3d23a4b5c3301c208124e

Download Submit