ca8e1dd2e6d9ea0ebec75f714d60d6246e04ee0fd97d6a077c0b96603990b73e

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.4 certificacion producto nacional.pdf
Size

102KB
MD5

fad97a69cf5a65545be4ba221f5a2c72
SHA1

b1c107ee93c11bf94fe4a12c1e6891b917cd5619
SHA256

73f9aaa7d6bd273471188d5968dbfd586ad425172671fb44ed7b2dd8131fff15
SHA512

cef314b7dae2186d22d6ca322a8c27d6aafb97abdac0fdd38547fe375c6a22391318f525163d51b79768971e593e8bae08867568bd0d32b6b135257e5a0fe4f5
SSDEEP

1536:OsnKWvCCZ8D4IHCLWNH7bB0S/dNmORkrFB2KWvCCZ8D4IHCLWLAyXKoS/dq3MMxP:OavvJZTUbSS3/vvJZTKXBS43MO

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2204 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

2204 AcroRd32.exe
2204 AcroRd32.exe
2204 AcroRd32.exe
2204 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

pid	process
2204	AcroRd32.exe

pid	process
2204	AcroRd32.exe
2204	AcroRd32.exe
2204	AcroRd32.exe
2204	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1.4 certificacion producto nacional.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4e694b3b679619eecf63d6059b2603e3

SHA1
65a870b73c57b2183a3d1c30284c16ad5e50689a

SHA256
ce0c0e6aee9c126fb251e5679bbc5d2464345fe9b0dab042985b1b45f9369aa4

SHA512
e6724636cf21ce8c19900b275d625492aea53f3561c9117bb40bedf7d6e4e2996152b694eb6b1fbe5a64bc5c751a65233bf72d25676a915662df8e2c1d90e9af

Download Submit