Analysis
- user interaction
yes - max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 14:17
Behavioral task
behavioral1
Sample
Retencion_PDF_29-09-2026_2817_Factura-Asociada-8281711_2.svg
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Retencion_PDF_29-09-2026_2817_Factura-Asociada-8281711_2.svg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target Retencion_PDF_29-09-2026_2817_Factura-Asociada-8281711_2.svg
- Size 322KB
- Sample260930-rl2mcahd23
- SHA256 fb3e7f0ac4143af00db58b25039c1949bf12def191b4d260c7bce57a2b6c402e
- MD5 11219d031a07591278a279fe53dc0768
- SHA1 7a874217ffc04020104c2120d0a9a6b8d20391bd
- SHA512 7bbd4ff03d0ca76517bd722dd43218225259ab90699a5378353cf012809e3748a5833293cfbb4b94da3ae76bb0b6d65e247943e4763b8e33aed0188da398ad6c
- SSDEEP 6144:oZo77wNymYm7MEpXOQThda/vhRJXOmwtG+Wp5+yM3cSqghXP6UtPvL:D77wNF9bFOCc/vhfmtG+0tFZsfl9L
- TLSH T1B6649E17D6AE6B4E5C1D3B11106A1E5AFED9CBBCEF767BC4F08F90A614EA1000B411A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281382" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281382" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497542845" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f5caeeee50dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b03ac6eeee50dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2360396215" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a0000000002000000000010660000000100002000000036bcc6385dd7cb18d7a63356b763c486db6f66234d04fc14493bf3fce8c824cc000000000e8000000002000020000000b7f0e75becdab8e3141457af7333edb2bd6eeb3e5e40728996bb45ac7043a1102000000056cfa4c35a6ec89e80c0d4e85ee38cc2f95eecb9826a0d874138071d2b6a2c7040000000b23c4d5acc46167deb7692ef10783406896dec20dec213818498c65cad69ca3e43c07022c64fdc367fa0e1f78e00a07b25af43d069537ab517ff3f6220474e7e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B7D49851-BCD9-11F1-8FDF-7E1CC8EA832A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b314b4e102993c4aba5dfc9fd3ab008a00000000020000000000106600000001000020000000d183d4a68baeea26b6211f57fa993052e6402e72a4b17be98f52fa3819bdf896000000000e800000000200002000000040cf59bf3af9b62fce5767336e908a445fbca4911235f5af31e89a70b286b702200000006d692f18bc2ef6f34496e125cb2ae9807165bc0fbc0b3c8c32496abc566f08e140000000e20a2ea5ec0e26f9bb2f153943f2f060e8f20df4f461e165c6367a2f3994c67f4079b65bc6cc7f79865db820cc67195d7b2632ac5caf9098e6ca0a93700d0f64 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2357114944" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4740 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4740 iexplore.exe 4740 iexplore.exe 4320 IEXPLORE.EXE 4320 IEXPLORE.EXE 4320 IEXPLORE.EXE 4320 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4740 wrote to memory of 4320 4740 iexplore.exe 85
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Retencion_PDF_29-09-2026_2817_Factura-Asociada-8281711_2.svg1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4740 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4320
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 7bbfea3c4b86e052f6c7c043ab8b86695e9e7f525cf54670ea3fed7eeb8fc07b
- MD5 c594b726a66926272d1a36f611dbee07
- SHA1 06692a4ae7abe3082ff08b78812de3b1c5e11251
- SHA512 0f0ee6de9885af7f67ac2aa53f021b49d3d9cb828025cfac627a6c9ca4b6b684c76d4f551763ed290b404695060b76901b701fb45288a58fd82e184ac9e1a309
- TLSH T11BF09E11A3B9D0D05BCEF4DD076D01B93160995F20D2032664BB49B45A417E73559530
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 96e37912f528b462d34a641436a19ce7ae559bf5c3f3f279b6572ef558f1ec50
- MD5 065ea5c6c9f0f09efab542097009aebd
- SHA1 9b67e5ab70b970fb3ef64678f55fc83e4e858930
- SHA512 3f77bb9baddf9508d42dd97d5e974de7cab6379faeac7f37c3edaf6f9a48bf91e569d24516f9b0b3b2a6d3d96d05c10411b44f143f34d2054383f02b24997ba6
- TLSH T1F8E0C03811F7411FE4E8D8344BD67521546DF032141992F42FD49F18BB02A40AC12A25
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U1Q3VPCN\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH