ddef05eae8e33c670421329f771fcda61d7bc9041e732698bb3a1cc28df8ef7b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12/03/2025, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Autoliquidaciones_1071142518_Consolidado.pdf
Size

51KB
MD5

48c6b51f190690a43c1afe1a6626b317
SHA1

9a87dfa49713c77f4ad00cd08bae0c720b9ea165
SHA256

45e6432b4a9c21f5ab7d1e727e95e70e00e956d09862413c812dbd2d3307de2b
SHA512

07580d39a12251dc1145a4e02a478430dd5a7cb721c0f03064caf63344f861eea73805964a2d04704b615be0ee0ad88f1ce618c88d36b737f5fef4f8cc19ec19
SSDEEP

768:xXxxSI/RBQLPge7BtPkf3k/08F/L5NiRuWQiqwkUPlnen1gwiekD1YyDD5EFwJXh:saBQLo6BSPCtlNSuWQiqwdPZwiTQwJXh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2760	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2760	AcroRd32.exe
2760	AcroRd32.exe
2760	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Autoliquidaciones_1071142518_Consolidado.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ad9bfa79f03f298f5264eb1eb570e298

SHA1
2cb7be442494fe0938731ff094b049c217213ae3

SHA256
49af3ea9a84a1b45e6f0255c0fb55735e577d5e45777446a7b4f75543c12324a

SHA512
eafc15eb250e43c0ef6406f104f597bebf9c39e6ec69ef9ee1c8b28ee638ad90c80d6cef93c9e5e4d00da8ad286a3619f769e7100ea82ba83fc92f0a88bba804

Download Submit
memory/2760-0-0x0000000002EA0000-0x0000000002F16000-memory.dmp

Filesize
472KB

Download