ebc228357437b98484efc94757a40fd3af4c0862d6968c451b88df34ead9bb9c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ZAWAJ/الزواج.pdf
Size

418KB
MD5

836b3de13d7ea01495af1d049f07b69e
SHA1

271d2b3c67702c788eac6f1c8b3079f8b3c3a675
SHA256

f3cedf45890bf6e5114a495f7c00df3d46e31d60296c04e57fe7ab7188c7cc5c
SHA512

ebbf052f288f78320f9868d695c331bf0b83b62fdeb06fab696fb5923c29f5cdd06c725f41d47cb0bff27dd9f722be48fd10608efc86d474a7d056d275ca7fba
SSDEEP

12288:2KcLIEKA/KlzUnoX+JsQUsRC5b31wiojxmDhU:2bNU+JTcCiojxmDy

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2740	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2740	AcroRd32.exe
2740	AcroRd32.exe
2740	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ZAWAJ\الزواج.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c120da77d06cc270b3f54a582d88fbc5

SHA1
93bdcf80195c50c3abf3d7d2a5b319a649be8068

SHA256
08615be8316a446efae50d1dd601b97aafc0e6c757d7908db069acef757383a2

SHA512
193dfe5f1ff24a198f632175e25304b70188eb96b4262e934d67d0786d7f68a6628c56ebc7fd21921ae7e636023919361d6398d2805e3a907a5e26c626e2cf19

Download Submit