4726db7fa32f6c204968dd2e4d289d4235254be54fd2150cf7569f91d0b57c01

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Info Enviada DIAN Acta de Visita 08112023/3.Contrato EP Buenavista ANH - UTOE_compressed.pdf
Size

10.8MB
MD5

701c68d0cd8a5fd8501e1f12e8bb40b7
SHA1

2582d8208263a1489281c8a7ea7168b27e69bd8a
SHA256

e332f4ccc20b8cf28c88d35df12d7b82913507190b17eb5ae0ca165bba5c046e
SHA512

54da58375fe23fa8ad603fac3f03d1177cf6910133f3fb16ac7eee844674e648d762235e297f0056b7a88b191768eb925655f99be4a5d4d0334e5de0d0dc3ca5
SSDEEP

196608:IJQFcVoKIk3VyULCwNzjlHAZZEgk5H0kWiCmgYVN6oyUDM/XKcs7HmbGeNY4d:kQq2hk34UvzjlHi695HczmlVBM/XJsLK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2408	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2408	AcroRd32.exe
2408	AcroRd32.exe
2408	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Info Enviada DIAN Acta de Visita 08112023\3.Contrato EP Buenavista ANH - UTOE_compressed.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f90186347cfceeff026ec7f70da9f7a5

SHA1
8c3833aa3fedf6e130f2e62365594eb155fc6409

SHA256
eb982eedb20cc54c89c59e948b1b57e10d985d1a324eb0da21c0090ff7529e63

SHA512
24e372a5e26eacdaf92e149a88a480c0999ba6cab368efc38bea9fcd2ab14ec0a520bae8aba151cb2a9823173ca8f2a825e2e7d4f289f2af39fa9e141ba9d375

Download Submit