ca8e1dd2e6d9ea0ebec75f714d60d6246e04ee0fd97d6a077c0b96603990b73e

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2.1 COMPOCISION ACCIONARIA NYR.pdf
Size

193KB
MD5

e7a93c1ff04249ff40b9a9a1f8a0e566
SHA1

d34c99dd63a3ce5d0c14e9fdb03a83eb8c0ba69c
SHA256

4701fb3ff1df7f5b5f0022fe9a11a65c1c53909ee785ec321a4ace0d387a69a5
SHA512

7d476e63fce4bdb6abb94a7948ade8151bec49b73dbc88d301187f838560a9b586ddb86e973a7dc0dcd49b8ec3fce44ee2cc423227c74671ebc823c726a2aa61
SSDEEP

6144:91YBAJT5JI/+7OPIeD4j3C3WpU6H6bGiD:4BA1I/+7OweDSK6H662

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2276 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2276 AcroRd32.exe
2276 AcroRd32.exe
2276 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2276	AcroRd32.exe

pid	process
2276	AcroRd32.exe
2276	AcroRd32.exe
2276	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2.1 COMPOCISION ACCIONARIA NYR.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8216cdb85931378ea9e98348a72257eb

SHA1
f259d47698fa14e068bbbdfe2e7fd65358d3e44e

SHA256
3a7dd25ef32e33df62f92f750748910d283b64d39dab5871630b5446df94da5e

SHA512
dc37a1a2179b7bd0206fe6ee42a98ae32b3b55ffebad65bd3e6ad6a38f0da87bec9268ad4e7f45958c0f14ad4fbdc67cf95d20ff44bac3528cf233ccf2c9983d

Download Submit