ebc228357437b98484efc94757a40fd3af4c0862d6968c451b88df34ead9bb9c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ZAWAJ/القائمة 5.pdf
Size

560KB
MD5

2e25856df0d38d4848508cc7f584a072
SHA1

658625f4b0d2b605293404e439784f4d17edcb38
SHA256

ac401cfff275a4c0d9c15160efb66fd54ee7f0b06360a558b9963ec5c9aa5b8b
SHA512

c85fbd913b8f823f5eba4aef9e73a4eee93400982baecb5c3771145786b9875ffe166bec3fd79893a62848d622c39818dc1bc32a51d32012b208dc2c7cebd21d
SSDEEP

12288:P7pfME4fTwqQQFYNbkxjuZNfoVtAc8XXQ6g1hHFFWj:j1MEI8qDqUKoYc1JRFFWj

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2272	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2272	AcroRd32.exe
2272	AcroRd32.exe
2272	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ZAWAJ\القائمة 5.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4a76e56a29539999286049f4711af25f

SHA1
9a72f3719478ec2e94a33c4469e218439a77b82f

SHA256
db58e7191a61bd6ab7e5fe7628d91e0688da2f3604799a870c47faf919a51b64

SHA512
c4b79b942f02d0efd6e223288e977bdf98b9fdc352597f4bcde16a544010933751d8c5f32f0aefc18e8fe363f3a74dadc365204e29b466342fa2baa32e72fc52

Download Submit