ebc228357437b98484efc94757a40fd3af4c0862d6968c451b88df34ead9bb9c

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ZAWAJ/القائمة 1.pdf
Size

506KB
MD5

21bb02f5b5acd8d46e81819da55cb926
SHA1

3702ef8dacff28d6dd261c0263e771f8192039b2
SHA256

f577228b376a3c7b140eed0f7e7115824412db8e12639b23fe1bad53141400e1
SHA512

77b0dd487e5dc040e6d308191d5f57dd939f9912a505d6ebeb71cf15c1e870390b8b841c779e52328ca69f22746b7754a98d11cb465adf4a8c6a6f1556e8cc2c
SSDEEP

12288:EKvNzm3m2uxrRI2+yW9HEOSigpEgoRsdp1d+4NN799:EgzOCIZyW9HEOSilg37xL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2232	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2232	AcroRd32.exe
2232	AcroRd32.exe
2232	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ZAWAJ\القائمة 1.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
df21ab86a5833fdcffc0a138eeb342c2

SHA1
6d9e10fe33889dc56b463330afc1b2c125d33d7f

SHA256
08c42319e48a11c1b96d69c8d5e90f919d768626bd984bb68b5df43bfe3100dc

SHA512
15232b6623e8358ac1360cbf7444d9b1f1179292e8e7d84ada8f3d438d4c608a792c25123a68a7a67ec15d3195f6949b656881bb7c1f08ecba8165dc01e4284f

Download Submit