ddef05eae8e33c670421329f771fcda61d7bc9041e732698bb3a1cc28df8ef7b

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/03/2025, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Autoliquidaciones_1071142983_Consolidado.pdf
Size

54KB
MD5

2a419551116368b34510df83e6c0937a
SHA1

99ab04f591831b7ac5a01c2af26ab48fc497fa26
SHA256

4f177a77ec39f2f5a67aa1d704c6e85d944f31e1fe88191cf7888bd2bbf7ce5b
SHA512

354fb4d2ecbb65c9f89a35d211ca55a7eb9e6169d6853b65b0778dafeca85b4be6262afc9a2da44b88cb693264eddfd7da29d4b78ffc3032bd97bc806de20fbc
SSDEEP

1536:mfmXf/iO/HsRy/KZapJkAYgDxvgc0EAECRK:x6EHDJNVRgjEAtM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2380	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2380	AcroRd32.exe
2380	AcroRd32.exe
2380	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Autoliquidaciones_1071142983_Consolidado.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c3f341a24465a0d2d9ab2834779444d0

SHA1
9604301af0cf7ded5b31c371d2f3931281b5c3e6

SHA256
074ea67c10833574f4f85230e103e12ff37f0dfe65905f0e977fd29d2dbe1ad7

SHA512
17cf09223905f42f237a9d8ae84261b796dad7330730af5269df1d8b0e14695066637648129264b681132bdb1922553f206f2ccc5e725995dfe759d112872a7c

Download Submit
memory/2380-0-0x0000000003B90000-0x0000000003C06000-memory.dmp

Filesize
472KB

Download