7e7263b7b42454388d2c7fe248ee2f214182d600ceac8314f640b97b9558340a

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NC-CFPL 4736 MERCADERIA IBAGUE.pdf
Size

106KB
MD5

36986476168119fed59f8a1ca0cfd2e0
SHA1

005ec1ecdc3679e8c38d855e83e584c3e76421ee
SHA256

b686f25d64968480ca945cf2b2c291bf1fc3ebfb49b2bdcb2f9e69cdc975f944
SHA512

08367190a22c289568655cb712ae7156703d4e499b965cf1314bb8ed27669554c19eeb8b146dc61d188adf51fd5a2f9c7a7ace0ea08cff36d9dcd5297331bd8c
SSDEEP

3072:pJ7Nxbhp4/BE4JZAuK0KA6FZJThLtDImoLx6:pHxPay4J9K1VRTp1WE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2392	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2392	AcroRd32.exe
2392	AcroRd32.exe
2392	AcroRd32.exe
2392	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NC-CFPL 4736 MERCADERIA IBAGUE.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e10b61b4cfa01828365e71bb5cb291e5

SHA1
8718489ee2409b4d9d903d6a1926d4475c081c94

SHA256
87d520d4e9debe672da62d6360a8e9f6ac2706d42deeef3430739fc77e1bbd0a

SHA512
f99fc695e719e76c0510017393bff88875f41774b28cdbcc93f93033032e15547d2c7c7e60106e7221acd8bd5405fbece9ba4717e4d92e1e5e83b57786996fb6

Download Submit