4726db7fa32f6c204968dd2e4d289d4235254be54fd2150cf7569f91d0b57c01

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10 Ingresos y Retenciones/UTOE.pdf
Size

98KB
MD5

4c9d11f0ecfc32a7a169f11f33c2457b
SHA1

f66706d86cb5cb1d69a0ea5009271cd78f29352a
SHA256

be2991774a516976b714f13a78da389e5ac6e8fddb88e9e69961605818870a97
SHA512

29c3be58c6b863e343ec73ea332390c255ccc2daeb9cd437b609bd475df54d3891e281d1027e6dcfa13facb83394f5619be04f431b33b9b60d55f025c43d70aa
SSDEEP

1536:WZudETga8iW6Vqy5xpK8NWyrPSvGCITtEC+toj0ouLeg6UVgd3yM4I4VMFEoV:ou+s+q98YSPWdM+56sLTBq62

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2644	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2644	AcroRd32.exe
2644	AcroRd32.exe
2644	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\10 Ingresos y Retenciones\UTOE.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
12041d42ab96c1c6333c00ac84544427

SHA1
a047a2822237e691426e8337641a8f01f803a42c

SHA256
3f6f9074397bf9aa1c370be952075e16a7540d785d46d7a65d53968274f156fd

SHA512
6d3d790c9529c820fe507fd6187e786109ed1f2b91a425ee6af5a17403267da21aec3746fe74f4d9bda4a0a36e5367acac45cd5e1bc61bae60ed416c4a3c2767

Download Submit