ca8e1dd2e6d9ea0ebec75f714d60d6246e04ee0fd97d6a077c0b96603990b73e

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10.3 ACREDITACION DECIMO CRITERIO PLUS ASEO.pdf
Size

132KB
MD5

f586b04a85aaf5415e8676d480726ceb
SHA1

fe53e36296f28ae161ace9c8553cdcc18ce916f6
SHA256

172682441907f329ee19ba01acd94f6ab88ff611ca69685b8bec78b3c2265fa7
SHA512

7467ef78d2b69f693ac9c0a4cd02f7804c2e0e2ba443fae44a46f3ff63b7dbe8109930ffae3c942a7da046516aeecdf4ead7f8df78db43c181c06cd13d53ada3
SSDEEP

1536:Lm2SOCDKh2OjiTeiF7dHlx06DTyQHFGepQMlUCFl3ZoC0YZcrIxKDuEjQ5XC4y3v:uO3hMF7dF/DTUoUuhPS8EjQUjg5Hf3s

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2656 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2656 AcroRd32.exe
2656 AcroRd32.exe
2656 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2656	AcroRd32.exe

pid	process
2656	AcroRd32.exe
2656	AcroRd32.exe
2656	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\10.3 ACREDITACION DECIMO CRITERIO PLUS ASEO.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
dd3672e77d911921bf256820cb0c3aab

SHA1
3c2f1bde8d886be53fe5544d621d1ffb251075d1

SHA256
8f03b4676da798bb171e285855d43a98dcb94ce114fcc5732bbc266c7816fc91

SHA512
477898dd1086f056159848ff21c867a2abf25aa21e241e5147a33125237b96464de794909abd3b268d051865e35fdb84979848698a5ea7ad3b743a82672f3230

Download Submit