4726db7fa32f6c204968dd2e4d289d4235254be54fd2150cf7569f91d0b57c01

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10 Ingresos y Retenciones/NKL - Certificado Vanti.pdf
Size

54KB
MD5

b6ca228f0b99695f79799139d1473e65
SHA1

f3a803b438f414cffdecba1ea01edd8fcf84ec72
SHA256

4ec28216de7cf1c55c267352a2a270ffb8f2546114856eb6a38cd9df0e19a39c
SHA512

f84f9e6ff6c599026c3c77ddbf195135c7cc6a2370bc1a9a1444f8da36051e6f73032f120e764e238a6625068c57e72446febdd7f8a9457b737aeff42e8aaebc
SSDEEP

1536:LQBY9Hosg/RWTYOkp6+/MkTyYazVTGvzfj/:LJ9Hosg/Z63QRa47fb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1728	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1728	AcroRd32.exe
1728	AcroRd32.exe
1728	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\10 Ingresos y Retenciones\NKL - Certificado Vanti.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5c40a44623e8c02e47776a6d1245769e

SHA1
c101deb7a896453e17341b5f8ce0b35e042ec185

SHA256
0141dddab519a5ca0bec3d476fd26b409fd961e317dff1fbfcd06b90aff7c481

SHA512
3587a5b8c111e1e4507324fb380292f7f740804dfdbeb3b6478f587353f5517e8b074ad043fdfc52a82b8f4e0557ffda25897457483956bf96a2dbee76e605fa

Download Submit