ebc228357437b98484efc94757a40fd3af4c0862d6968c451b88df34ead9bb9c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ZAWAJ/القائمة 3.pdf
Size

545KB
MD5

44cd508a1b16e89e4f15890199ec29f1
SHA1

6d05c49da668cdc217acea1d60f8c8172aa92f25
SHA256

d1bd1ae3e121f6c3dcdd2dfb11acd40744b3c4804f106b0ece207b2f63be6c19
SHA512

0977cf98194a722200c82e5186ae92df02f367fb4e81237326a1e2aa1278ab9e4cdde95dc495832eebb26e9c15bf396f67157192e0a2455cb14337346ff9a9d8
SSDEEP

12288:O6rtqMyHsWsdLGlPy8eCpshduSALsaRQV1g6HOEz:ZtcMWsdSo8rLS6saejg6u4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2872	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2872	AcroRd32.exe
2872	AcroRd32.exe
2872	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ZAWAJ\القائمة 3.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
484e50202d89ca47207835dd84cb9fad

SHA1
b3de5f408f2a9d866101a2a260fdf9350aa3cb37

SHA256
e806b7977f37be4073d9c1d923a46fa09bd30248cc04af673920d3c06afacb04

SHA512
9f29ad15e199262522a12f3e11f695845735991c622e465fc1a930c8e76a686dbe0e6410b9dbbdb5f8cd0b0196ad5212b8110b6a96088cbc1bdaed21337af4e3

Download Submit